General
-
Target
payment-534.pdf.exe
-
Size
1.1MB
-
Sample
231219-sj14gabdem
-
MD5
fcbb18ac3efebbcbe42999b718ba2995
-
SHA1
8771d111792d957cbf775c7eecd743be4b49d0a7
-
SHA256
1d16237ed75b507f03609ede9722fff429f9a7386c4c4408a9f47623d7a28b50
-
SHA512
84ee10f0f75694d3dfca2c67e2899cfc0b31ffb9cdfdd4b8666d8f68ab1acc9be6da02e354a14a070b51ea173b36030e492047df6a1d3f2f5bd1679f817a9cc1
-
SSDEEP
24576:mYrGdfC41+CruFtTRXispYjwLf1JxuAnHWsKjIo1zMh:FZ41+CraTRXikxJsAnHWsKso1zMh
Static task
static1
Behavioral task
behavioral1
Sample
payment-534.pdf.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
payment-534.pdf.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
megatechcontrol.com - Port:
587 - Username:
[email protected] - Password:
megatech1#
Targets
-
-
Target
payment-534.pdf.exe
-
Size
1.1MB
-
MD5
fcbb18ac3efebbcbe42999b718ba2995
-
SHA1
8771d111792d957cbf775c7eecd743be4b49d0a7
-
SHA256
1d16237ed75b507f03609ede9722fff429f9a7386c4c4408a9f47623d7a28b50
-
SHA512
84ee10f0f75694d3dfca2c67e2899cfc0b31ffb9cdfdd4b8666d8f68ab1acc9be6da02e354a14a070b51ea173b36030e492047df6a1d3f2f5bd1679f817a9cc1
-
SSDEEP
24576:mYrGdfC41+CruFtTRXispYjwLf1JxuAnHWsKjIo1zMh:FZ41+CraTRXikxJsAnHWsKso1zMh
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-