General
-
Target
SCAN 000073.zip
-
Size
252KB
-
Sample
211019-ltsrhsgdgk
-
MD5
3d075d51be28e9015dae6caa2f2e1e37
-
SHA1
a8c2e7175f0f9410e1367ee8a9ff303b2a8454ed
-
SHA256
34ab4fe47df80793d8da4d2d6196cc53722c9cf31f801d4818d2d4f2d7f799cb
-
SHA512
cd148b0b64e9046db5a1d160c857cdb6e46c225e89ede7efe5fad420cad87db6e35b34f3123451b1765fdec28ddf44e4f201d8b327ec35d78b3628f7897fd65b
Static task
static1
Behavioral task
behavioral1
Sample
eLJyojaW0RFPJhK.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
eLJyojaW0RFPJhK.exe
Resource
win10-en-20210920
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
smtp.vivaldi.net - Port:
587 - Username:
[email protected] - Password:
#munachimso#
Targets
-
-
Target
eLJyojaW0RFPJhK.exe
-
Size
278KB
-
MD5
6c218e353026cac8c9aa59fc494a14b9
-
SHA1
eaed3e0789b749dc2e188fd26a9f9cbc50314d5f
-
SHA256
b2acbb9c56fba0cbe5cabd76b5df537059df5644958924ec3ee7d8578666c9ba
-
SHA512
3cbc6e0244e9178762afb5b13b3553204c30f6ada1f2ee1b2deb9764a2156ab6d0ab2741087915c7351811aefaeb1c364d9d256ae571fc7a8948b5d75fae4ff1
Score10/10-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-