General
-
Target
Details.exe
-
Size
399KB
-
Sample
211201-jhkknadgd5
-
MD5
4a2394c58bbba9bd7d72f10c4f0cbc70
-
SHA1
4b4de49d29474fcbbc0fed996e551848d14ef5e8
-
SHA256
1909bc166ed4a9211d5d4fff2baf93a07268335ac80b372b0552fe414013d45d
-
SHA512
026686a8769fdf1d779ede9bb6e1e9cf448e4677086d078eee4500f8d40d6e2630b46185adaad8c48221f80430afd1d97abf0ffc6917b34355b9b127693ef5be
Static task
static1
Behavioral task
behavioral1
Sample
Details.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
Details.exe
Resource
win10-en-20211104
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.greentrading.com.pk - Port:
26 - Username:
info@greentrading.com.pk - Password:
lovetoall
Targets
-
-
Target
Details.exe
-
Size
399KB
-
MD5
4a2394c58bbba9bd7d72f10c4f0cbc70
-
SHA1
4b4de49d29474fcbbc0fed996e551848d14ef5e8
-
SHA256
1909bc166ed4a9211d5d4fff2baf93a07268335ac80b372b0552fe414013d45d
-
SHA512
026686a8769fdf1d779ede9bb6e1e9cf448e4677086d078eee4500f8d40d6e2630b46185adaad8c48221f80430afd1d97abf0ffc6917b34355b9b127693ef5be
Score10/10-
Snake Keylogger Payload
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-