General
-
Target
Purchase Order.exe
-
Size
646KB
-
Sample
211129-v8ww6acecn
-
MD5
81fd4388b69e6a45fadc3c00d707bad9
-
SHA1
6764e7f5364ffcfe8b7f9a9363593a3b3ae341d9
-
SHA256
36d2b54a52e78bfb66294bce0215b4225d56e013dd83e003515ff4dab0bcbb2a
-
SHA512
280973856000e4517beb4a5f1c5cb2e3ff1dbe72f7ccd927a72ea326a122d9254f801a97a45590e680ba7a21e2356b298a9a7b2620f498b52daccc0a91751e83
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
Purchase Order.exe
Resource
win10-en-20211014
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
admin@siemens-energy.cam - Password:
antivenom
Targets
-
-
Target
Purchase Order.exe
-
Size
646KB
-
MD5
81fd4388b69e6a45fadc3c00d707bad9
-
SHA1
6764e7f5364ffcfe8b7f9a9363593a3b3ae341d9
-
SHA256
36d2b54a52e78bfb66294bce0215b4225d56e013dd83e003515ff4dab0bcbb2a
-
SHA512
280973856000e4517beb4a5f1c5cb2e3ff1dbe72f7ccd927a72ea326a122d9254f801a97a45590e680ba7a21e2356b298a9a7b2620f498b52daccc0a91751e83
Score10/10-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-