General
-
Target
お見積り依頼.zip
-
Size
535KB
-
Sample
241001-f42vaasfrk
-
MD5
2f3ca647a3478f8ebb9852cfdf57e434
-
SHA1
92ac953049dcd5d460324b3c013d1a007a9d0d6f
-
SHA256
46378c35c0c77c88373bba99ade6bc0b3b773a0fc4b80afb263b2bd02145a62b
-
SHA512
5b8064f22db75d17f005b497b1f3b509aeacf681b9419ccef3f32fa54ccbe8895b0c4189ea9787e0854d39c953a7861805542346484e5e8492d21103e0f5e978
-
SSDEEP
12288:ZF1/lvG09Yb0aYIgYtSCFfBM445zsqbgHps/Ih9BgsutEWDg:1QIE0aYIgYFZM4v52Ih9BGtjM
Malware Config
Targets
-
-
Target
お見積り依頼.exe
-
Size
630KB
-
MD5
728097746e8c33931674db66a3e707a1
-
SHA1
b3370f0d1f3627ef07e1f0a5ca0ecb29ba1d51b4
-
SHA256
40ea892bdc93f4572d6bf98bcfe64444b304d3295ac956b24756152fed8ed97e
-
SHA512
dd33fa59a0bfa914c55edcc15db3e5220f75cdae4dcf0ae549792970e558b80e486a9942c93d9f7673edc17a33ddb184ea65445b8ae001d2155620da36a4dcf8
-
SSDEEP
12288:/R1/lvG0+2fXd+aP7zsCbgZpsLIStlsZifh:/zQ9VaPExeISwa
Score10/10-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-