General
-
Target
Revised Offer.doc
-
Size
22KB
-
Sample
221128-nz117aff6w
-
MD5
14ec89b35126d6529a0ac2500bbfc12c
-
SHA1
6bf370828c12270c9e2e941b0b47a96de9ef0256
-
SHA256
77be1b4b42c069b513628a90e7d70dafed14dbb280bd92665f3c7e872af46ee9
-
SHA512
df4ca4c386ef1caf0cf5ec8f1790f7c4a3f295646a840d26c1ee08f2a6ee9973dc12b10e027c3775e704afaa2caa181578fd3d42024b13f7e214775a45739cee
-
SSDEEP
384:VQMmdOFNYY0aaaIswqPeOrka1+fHQJ+t3rQkRhZtaenFdN7y5ksl26emMJtjyMGG:DFx0XaIsnPRIa4fwJMXaeF/7y+Y2Sk80
Static task
static1
Behavioral task
behavioral1
Sample
Revised Offer.rtf
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Revised Offer.rtf
Resource
win10v2004-20220812-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
cp5ua.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$ - Email To:
[email protected]
Targets
-
-
Target
Revised Offer.doc
-
Size
22KB
-
MD5
14ec89b35126d6529a0ac2500bbfc12c
-
SHA1
6bf370828c12270c9e2e941b0b47a96de9ef0256
-
SHA256
77be1b4b42c069b513628a90e7d70dafed14dbb280bd92665f3c7e872af46ee9
-
SHA512
df4ca4c386ef1caf0cf5ec8f1790f7c4a3f295646a840d26c1ee08f2a6ee9973dc12b10e027c3775e704afaa2caa181578fd3d42024b13f7e214775a45739cee
-
SSDEEP
384:VQMmdOFNYY0aaaIswqPeOrka1+fHQJ+t3rQkRhZtaenFdN7y5ksl26emMJtjyMGG:DFx0XaIsnPRIa4fwJMXaeF/7y+Y2Sk80
Score10/10-
Snake Keylogger payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-