General
-
Target
DHL ARRIVAL NOTICEHAWB R129724.exe
-
Size
1021KB
-
Sample
221003-hsm8vsdhbm
-
MD5
cdffa75d5e2ddd08d8bcf06fcd862287
-
SHA1
edfc877cc23104f9aebbf9ab61bd3a9138c61f2e
-
SHA256
2b1fe6ab9c50dc0c63ce603e89acf924f3ff04558f67e13cf404a56964f7ba4d
-
SHA512
fab502ec10586411ad969e95db9ee14a9dc2a688440483764fffe88eac4415d459d0ff9497e3d6073a4139d9833ba3651ed9177fdc2634496640f4ac1151e30b
-
SSDEEP
12288:Tqvvfw2iNZ9yIXggzbEEZL2ASMGD0tJcHq60l7Xf6St1qRzjkrrO7jQ6k6ErhoM+:Tq3o1//gqbJt26HXWjGq7c6km4
Static task
static1
Behavioral task
behavioral1
Sample
DHL ARRIVAL NOTICEHAWB R129724.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
DHL ARRIVAL NOTICEHAWB R129724.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
exp@jaiqroup.com - Password:
Chelseamel@22 - Email To:
exp@jaiqroup.com
Targets
-
-
Target
DHL ARRIVAL NOTICEHAWB R129724.exe
-
Size
1021KB
-
MD5
cdffa75d5e2ddd08d8bcf06fcd862287
-
SHA1
edfc877cc23104f9aebbf9ab61bd3a9138c61f2e
-
SHA256
2b1fe6ab9c50dc0c63ce603e89acf924f3ff04558f67e13cf404a56964f7ba4d
-
SHA512
fab502ec10586411ad969e95db9ee14a9dc2a688440483764fffe88eac4415d459d0ff9497e3d6073a4139d9833ba3651ed9177fdc2634496640f4ac1151e30b
-
SSDEEP
12288:Tqvvfw2iNZ9yIXggzbEEZL2ASMGD0tJcHq60l7Xf6St1qRzjkrrO7jQ6k6ErhoM+:Tq3o1//gqbJt26HXWjGq7c6km4
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-