General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.21665.13004
-
Size
583KB
-
Sample
231211-f293waebgp
-
MD5
78019d76135bfb355994f73b5e79f723
-
SHA1
1a257754f4c9e2c375f53b2d6aa71e8414e21d47
-
SHA256
0dbc86c5875d5ffa658b1a9a0d2011bbda706ab0c1909a905824046321251027
-
SHA512
6cbb49beae0b8e63b1ab4e930118eeb357ef905fe66f05d29fc699b55f3ed1debb40c7f023a20a47072d87d6526d60f2b78772cd1338ab6df201fa888008ec43
-
SSDEEP
12288:/3IU8S6eUdqUu7HnYzNncfTdR8ogr22jX6rg5:PItSAd/u7YlcfHFgrYU5
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.PWSX-gen.21665.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.PWSX-gen.21665.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.alualuminium.com.my - Port:
587 - Username:
[email protected] - Password:
U8G4S13#8Zk$ - Email To:
[email protected]
Targets
-
-
Target
SecuriteInfo.com.Win32.PWSX-gen.21665.13004
-
Size
583KB
-
MD5
78019d76135bfb355994f73b5e79f723
-
SHA1
1a257754f4c9e2c375f53b2d6aa71e8414e21d47
-
SHA256
0dbc86c5875d5ffa658b1a9a0d2011bbda706ab0c1909a905824046321251027
-
SHA512
6cbb49beae0b8e63b1ab4e930118eeb357ef905fe66f05d29fc699b55f3ed1debb40c7f023a20a47072d87d6526d60f2b78772cd1338ab6df201fa888008ec43
-
SSDEEP
12288:/3IU8S6eUdqUu7HnYzNncfTdR8ogr22jX6rg5:PItSAd/u7YlcfHFgrYU5
Score10/10-
Detect ZGRat V1
-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-