General
-
Target
ORDER_02_881_2021_PDF.exe
-
Size
1008KB
-
Sample
211208-sy76bshdap
-
MD5
55a42d9d730d2afd1ade9ce0d78ab55a
-
SHA1
ea6c11b0db287b93acb591ee15c347cf19d4c4d7
-
SHA256
94898a8d5f9a4d770639415a39a5220333f4ef8c1b3d0d1155c466aa53fc5af6
-
SHA512
ae222eaca6f9dacc738872ebd18918e1850a21b1ba011b339cefadc6e3e8f3ca01c60b32faa4cb64e97bccbf08a40063c081d96ca96f914b63cba8b13304a561
Static task
static1
Behavioral task
behavioral1
Sample
ORDER_02_881_2021_PDF.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
ORDER_02_881_2021_PDF.exe
Resource
win10-en-20211208
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.albasrahflag.com - Port:
587 - Username:
tevex@albasrahflag.com - Password:
o*79Gj3efyyA
Targets
-
-
Target
ORDER_02_881_2021_PDF.exe
-
Size
1008KB
-
MD5
55a42d9d730d2afd1ade9ce0d78ab55a
-
SHA1
ea6c11b0db287b93acb591ee15c347cf19d4c4d7
-
SHA256
94898a8d5f9a4d770639415a39a5220333f4ef8c1b3d0d1155c466aa53fc5af6
-
SHA512
ae222eaca6f9dacc738872ebd18918e1850a21b1ba011b339cefadc6e3e8f3ca01c60b32faa4cb64e97bccbf08a40063c081d96ca96f914b63cba8b13304a561
Score10/10-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-