General
-
Target
New order#2_W43.exe
-
Size
283KB
-
Sample
230328-gzb9haba9w
-
MD5
6e039c88706de216f5868b3a5a6907c8
-
SHA1
059c31716cd028e75825d2424690ae23d16609db
-
SHA256
9901b6b09b65e36a881dcebc20d5dffa8e70f1258fefa766566f3e17614d7f08
-
SHA512
040ef1dbc56a57d0e68255207f3370f355d242f5c364039b08d3c2615227a7b6a2479e9d8f88461acadd1be9bc2e67160bbcdaa57a02922d6428d14aba9cfe06
-
SSDEEP
6144:PYa6OoOx/cjH90btFuGj484hGnyNE8sEz5/3P:PYw/hcjd0JcHnhGYow5X
Static task
static1
Behavioral task
behavioral1
Sample
New order#2_W43.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
New order#2_W43.exe
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
New order#2_W43.exe
-
Size
283KB
-
MD5
6e039c88706de216f5868b3a5a6907c8
-
SHA1
059c31716cd028e75825d2424690ae23d16609db
-
SHA256
9901b6b09b65e36a881dcebc20d5dffa8e70f1258fefa766566f3e17614d7f08
-
SHA512
040ef1dbc56a57d0e68255207f3370f355d242f5c364039b08d3c2615227a7b6a2479e9d8f88461acadd1be9bc2e67160bbcdaa57a02922d6428d14aba9cfe06
-
SSDEEP
6144:PYa6OoOx/cjH90btFuGj484hGnyNE8sEz5/3P:PYw/hcjd0JcHnhGYow5X
Score10/10-
Snake Keylogger payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-