General
-
Target
swift000287371 pdf.exe
-
Size
228KB
-
Sample
230605-gkp7tafe9s
-
MD5
d2f69d9c47e7f2366f543add149ca244
-
SHA1
8bd6695c25885083d453b8dca4737c526f971112
-
SHA256
f0c75cb76a65d88fae996c3a1dfed3cd3da715e5dc06ec5a5ebe43db8d162865
-
SHA512
5d3d35fa7a36f9e1f2be5f80c553d51a8760001cf865e35e9efb290a86e21b93e4d3e387ff73be63107e2c063dbcb59002be1d51857d7c0280d622c54b9e3c06
-
SSDEEP
6144:N9EfCUrDQXdCjFGhOKLXWVu01KisJv0bpESnMbX8:N9EfzDQcjFG3Wgc6uqSMD
Static task
static1
Behavioral task
behavioral1
Sample
swift000287371 pdf.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
swift000287371 pdf.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
uglyhousebuy.com - Port:
587 - Username:
win@uglyhousebuy.com - Password:
]YSPgjNCuF;W
Targets
-
-
Target
swift000287371 pdf.exe
-
Size
228KB
-
MD5
d2f69d9c47e7f2366f543add149ca244
-
SHA1
8bd6695c25885083d453b8dca4737c526f971112
-
SHA256
f0c75cb76a65d88fae996c3a1dfed3cd3da715e5dc06ec5a5ebe43db8d162865
-
SHA512
5d3d35fa7a36f9e1f2be5f80c553d51a8760001cf865e35e9efb290a86e21b93e4d3e387ff73be63107e2c063dbcb59002be1d51857d7c0280d622c54b9e3c06
-
SSDEEP
6144:N9EfCUrDQXdCjFGhOKLXWVu01KisJv0bpESnMbX8:N9EfzDQcjFG3Wgc6uqSMD
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-