General
-
Target
New Order.PDF.exe
-
Size
1.4MB
-
Sample
230610-l4hz3aef44
-
MD5
221a7d979449a273c52f5b366c9e0fa3
-
SHA1
c1431c053fc93b26649515be2c50412be5d53131
-
SHA256
a5490f7978dc607068fbe21efd1095cf679defebf7044b93db0456c31ce279f7
-
SHA512
7cc1c62033edfa450d6204cf80a09662373fb36d77e27ae0582f933cbdf27143106068446235362f1224bd059dff755d3959cd387a5323823bc028cfbd212841
-
SSDEEP
24576:lTbBv5rUFcDJvGnna/O6ZNqmSEF9SvXeMi0j8x+B5A4d7UGOQ8Ox+4O4OkBrUj:PBHJvGnaJZcmSvXeMdj8xyxb/x+44Sr0
Static task
static1
Behavioral task
behavioral1
Sample
New Order.PDF.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
New Order.PDF.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5725545513:AAF0ULWHvMJTLlnqMYoWe0CkOpQ7zVO0wLI/sendMessage?chat_id=5738281136
Targets
-
-
Target
New Order.PDF.exe
-
Size
1.4MB
-
MD5
221a7d979449a273c52f5b366c9e0fa3
-
SHA1
c1431c053fc93b26649515be2c50412be5d53131
-
SHA256
a5490f7978dc607068fbe21efd1095cf679defebf7044b93db0456c31ce279f7
-
SHA512
7cc1c62033edfa450d6204cf80a09662373fb36d77e27ae0582f933cbdf27143106068446235362f1224bd059dff755d3959cd387a5323823bc028cfbd212841
-
SSDEEP
24576:lTbBv5rUFcDJvGnna/O6ZNqmSEF9SvXeMi0j8x+B5A4d7UGOQ8Ox+4O4OkBrUj:PBHJvGnaJZcmSvXeMdj8xyxb/x+44Sr0
-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-