General
-
Target
FTD_21000160852doc.exe
-
Size
2.2MB
-
Sample
211020-g53cwahfcq
-
MD5
63c984080f6aaec5b7f2dca4af13c5f8
-
SHA1
96b051a0df6708b89f9fa70fccb4729ed7e316dd
-
SHA256
1216db955da408a0070ebd68abffd6978e62363fe917b55688b9df9f253d58cb
-
SHA512
6318ee0788752b03bd321d4c771deaa0fc7fadb28db4a8b76db418a98531eaed31c099fd7d45afdf32dce60249a6f899ae956cb37ad891153bd4f2537fef3133
Static task
static1
Behavioral task
behavioral1
Sample
FTD_21000160852doc.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
FTD_21000160852doc.exe
Resource
win10-en-20210920
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
restd.xyz - Port:
587 - Username:
[email protected] - Password:
gg@6{ZL65h,*
Targets
-
-
Target
FTD_21000160852doc.exe
-
Size
2.2MB
-
MD5
63c984080f6aaec5b7f2dca4af13c5f8
-
SHA1
96b051a0df6708b89f9fa70fccb4729ed7e316dd
-
SHA256
1216db955da408a0070ebd68abffd6978e62363fe917b55688b9df9f253d58cb
-
SHA512
6318ee0788752b03bd321d4c771deaa0fc7fadb28db4a8b76db418a98531eaed31c099fd7d45afdf32dce60249a6f899ae956cb37ad891153bd4f2537fef3133
Score10/10-
Executes dropped EXE
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-