General
-
Target
AWB DHL DOCUMENTS.exe
-
Size
572KB
-
Sample
221128-janmcabb7v
-
MD5
c17afea02b5e501502811567d427e3ac
-
SHA1
3fdd61955f08ef20da9c1545915f2baa57fbf585
-
SHA256
0ca6f42f7efb21a5b4a93bbe6c2c4f69e9f9381f2a858872dd82df7e01332f7a
-
SHA512
5224f3aeb82cadfe2219774f72ba43a9b5e898a4ef6d8f79e70c194879fcab600f772b383a95ddb8e1728a37866cf20c98d6dc8a853a40ad43eb0524dbc68cca
-
SSDEEP
12288:h0cjpbKbftQbgTxGVi85gxRCMHZx912yx+:hPVbKRQMdGVPgWsZX1R
Static task
static1
Behavioral task
behavioral1
Sample
AWB DHL DOCUMENTS.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
AWB DHL DOCUMENTS.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
AWB DHL DOCUMENTS.exe
-
Size
572KB
-
MD5
c17afea02b5e501502811567d427e3ac
-
SHA1
3fdd61955f08ef20da9c1545915f2baa57fbf585
-
SHA256
0ca6f42f7efb21a5b4a93bbe6c2c4f69e9f9381f2a858872dd82df7e01332f7a
-
SHA512
5224f3aeb82cadfe2219774f72ba43a9b5e898a4ef6d8f79e70c194879fcab600f772b383a95ddb8e1728a37866cf20c98d6dc8a853a40ad43eb0524dbc68cca
-
SSDEEP
12288:h0cjpbKbftQbgTxGVi85gxRCMHZx912yx+:hPVbKRQMdGVPgWsZX1R
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-