General
-
Target
123a2fd9255e3285f34efb0a1c12550a_JaffaCakes118
-
Size
399KB
-
Sample
240626-ranaksxflf
-
MD5
123a2fd9255e3285f34efb0a1c12550a
-
SHA1
b30dd05c3476cd427ffb3ad2239e1cd84468d89f
-
SHA256
cc7a9cc66826d88bfd4422f25922a27e962165f389d9ed20ab4f0c03d2578f93
-
SHA512
c3aa96bff9f63114a58f86ac2e4b0c3e2d51d97be46ef58c4d525423f1d3bd79c9bb1d0cd1bfda5e98eb453a4f80eacd138991a4aecf483e86d8019dda89f2dd
-
SSDEEP
6144:HvYAIIiUf3CyymnqqSRLUmSxIE83TeUsGOEWCIPg8iddYEO0oUypj/eHryAJhYtp:fIIiPsqqSR2F836UPOz7go7jGdQb/dv
Static task
static1
Behavioral task
behavioral1
Sample
PO 2006-020 MAQQO,zip.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
PO 2006-020 MAQQO,zip.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
smtp.imginternational.xyz - Port:
587 - Username:
[email protected] - Password:
wiD(FZbJz5
Targets
-
-
Target
PO 2006-020 MAQQO,zip
-
Size
543KB
-
MD5
292bc3dc496528a9b746ead70389f521
-
SHA1
09e7998aeaa516e8c6baf19b2da1714d7680a596
-
SHA256
efae7b31af29601a11d4648abb3b27ec935fe97ea88468edf742d90c73ea0473
-
SHA512
97935ef1f0af6a2e3766fa14f908995d2555adc050344dc4a720c9fbf3dbfdb492839a08f94a9043cfae215ee02015a5ce60a8b8da822b2ef557fd65416aa16c
-
SSDEEP
12288:WtEBkXkAUqqSR2FO36UxOzX0g7jKBwEneoC:DAFzR20NxOzvKI
Score10/10-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-