General
-
Target
new order.exe
-
Size
482KB
-
Sample
240629-dse52ashlk
-
MD5
01c1bc3aa16ddb58b7d0fd28a723251f
-
SHA1
782bfcfcf7f66a98c280a9a39d852f6e238a0478
-
SHA256
da6b0f4662ab7c277189dafa7f323551c54982b2d54466feefc27d83a3c90e3c
-
SHA512
ecf618c120de072bf747ad3e45dc872b3dcd2e58cdc7dbf2bb1816d5560c9ea168ce968e99b09f126a17290e5bd37b5bf5c6f61a82e5008c0723478eeff2da50
-
SSDEEP
6144:wXuAPKbOs/ASmh4okC/fLWt+MJLwVXSGN8hOCXODNlPK5HFTkXkX9I8:wXuBV/FmaorLWtzCiyNQl
Static task
static1
Behavioral task
behavioral1
Sample
new order.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
new order.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
valleycountysar.org - Port:
26 - Username:
[email protected] - Password:
fY,FLoadtsiF
Targets
-
-
Target
new order.exe
-
Size
482KB
-
MD5
01c1bc3aa16ddb58b7d0fd28a723251f
-
SHA1
782bfcfcf7f66a98c280a9a39d852f6e238a0478
-
SHA256
da6b0f4662ab7c277189dafa7f323551c54982b2d54466feefc27d83a3c90e3c
-
SHA512
ecf618c120de072bf747ad3e45dc872b3dcd2e58cdc7dbf2bb1816d5560c9ea168ce968e99b09f126a17290e5bd37b5bf5c6f61a82e5008c0723478eeff2da50
-
SSDEEP
6144:wXuAPKbOs/ASmh4okC/fLWt+MJLwVXSGN8hOCXODNlPK5HFTkXkX9I8:wXuBV/FmaorLWtzCiyNQl
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-