General
-
Target
a72f3d7698f6126013cff4e4ad1fb808.exe
-
Size
1.7MB
-
Sample
211205-jaaeqaehc7
-
MD5
a72f3d7698f6126013cff4e4ad1fb808
-
SHA1
cd44ae59eb8ae4111c53e8b4a3da5e7ba1af48bb
-
SHA256
71ae3e49cd3e22ac2de6cc53dd6b662d8f65d8f4d9f4e882e1b88d3cff18e18c
-
SHA512
1c23c290cc4ce5876a7f86677da352e9229c387f03ef504a6287978001bb228b85aea46eb4493f886a1602691fa2b85cca3addf5c487a303ac590ab454db501b
Static task
static1
Behavioral task
behavioral1
Sample
a72f3d7698f6126013cff4e4ad1fb808.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
a72f3d7698f6126013cff4e4ad1fb808.exe
Resource
win10-en-20211014
Malware Config
Extracted
Protocol: smtp- Host:
mail.nclanka.lk - Port:
587 - Username:
sales@nclanka.lk - Password:
OgNl@$200
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.nclanka.lk - Port:
587 - Username:
sales@nclanka.lk - Password:
OgNl@$200
Targets
-
-
Target
a72f3d7698f6126013cff4e4ad1fb808.exe
-
Size
1.7MB
-
MD5
a72f3d7698f6126013cff4e4ad1fb808
-
SHA1
cd44ae59eb8ae4111c53e8b4a3da5e7ba1af48bb
-
SHA256
71ae3e49cd3e22ac2de6cc53dd6b662d8f65d8f4d9f4e882e1b88d3cff18e18c
-
SHA512
1c23c290cc4ce5876a7f86677da352e9229c387f03ef504a6287978001bb228b85aea46eb4493f886a1602691fa2b85cca3addf5c487a303ac590ab454db501b
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-