General
-
Target
4.lha
-
Size
78KB
-
Sample
241115-rarb8synan
-
MD5
8ff9c5a6c68cfff4d269681d0297fa50
-
SHA1
d26394e2b539382b9e90d03649266b0fddfb609d
-
SHA256
2275d7af7032d6f742787cb55bdb4a24c0441b9ef251467ff5a88c028882e9f7
-
SHA512
cbfd772a5a246902fc0ee6f62d50823bdc192c6b463c1463ba57b6f356d805165f52471887aa819beee4c0cc2b0c89412fd7d1dc70987a3566661fb0c62fe83c
-
SSDEEP
1536:2JKiEaWT6XgpDuff/hwoUSdpFXs0RhDE4AlnbyhB3+kz/sW:AW+X0Dk/hwHSdjXVRhIflbyHVz/X
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION_NOVQTRA071244PDF.scr
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
QUOTATION_NOVQTRA071244PDF.scr
Resource
win10v2004-20241007-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
gator3220.hostgator.com - Port:
587 - Username:
[email protected] - Password:
sqlv#))OxYLxAXyhMyi
Targets
-
-
Target
QUOTATION_NOVQTRA071244PDF.scr
-
Size
183KB
-
MD5
c0ff92d3f8d44d4b144d62a25203fb54
-
SHA1
7c629df73009ae5e11173087b8b899efb0bcc1e7
-
SHA256
1714590ed838170aed9ae4fcf702db472b860f5e4efaf25056aae4c219ce9921
-
SHA512
ef7829d88818df1e768242d12d25dd49b2d9afb15bab3fbced8e8b30de1530aa74842a3e37729391f4f068944d2b98eef3cf561e686c78e535cc6559e54f4221
-
SSDEEP
3072:JZpuHH5banPQKWBTVOc8pdOo6NPzKkwGLu0AsxLzBuO:JDunNsPeBsc8dOo6NPuk5ixsFzBu
Score10/10-
Snake Keylogger payload
-
Snakekeylogger family
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-