General
-
Target
a5fcf5261f4b435bed88c35c3fff8b6d.exe
-
Size
455KB
-
Sample
211128-jczgmabga7
-
MD5
a5fcf5261f4b435bed88c35c3fff8b6d
-
SHA1
5a6711348740dd461b81609558baa4a443037134
-
SHA256
64856436723994f4f26b7046359ae21298201aabe519c9041c374b508c0abc16
-
SHA512
95500e5879544f2bd17736d0d3f2bb9d5db388c6fb8c94027bd75a704e3e4ff288fb59902563dfe5a32fb9efb885495f9c8f32051e2393614bd15b90ad1ff63f
Static task
static1
Behavioral task
behavioral1
Sample
a5fcf5261f4b435bed88c35c3fff8b6d.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
a5fcf5261f4b435bed88c35c3fff8b6d.exe
Resource
win10-en-20211104
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
ilbgone.cyou - Port:
587 - Username:
applefield@ilbgone.cyou - Password:
C$Okrz^W$#?d
Targets
-
-
Target
a5fcf5261f4b435bed88c35c3fff8b6d.exe
-
Size
455KB
-
MD5
a5fcf5261f4b435bed88c35c3fff8b6d
-
SHA1
5a6711348740dd461b81609558baa4a443037134
-
SHA256
64856436723994f4f26b7046359ae21298201aabe519c9041c374b508c0abc16
-
SHA512
95500e5879544f2bd17736d0d3f2bb9d5db388c6fb8c94027bd75a704e3e4ff288fb59902563dfe5a32fb9efb885495f9c8f32051e2393614bd15b90ad1ff63f
Score10/10-
Executes dropped EXE
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-