General
-
Target
Bank Slip 2.doc
-
Size
415KB
-
Sample
240701-wmfhqa1fpd
-
MD5
ff06a87dd0550386be1f780d560f1877
-
SHA1
69e95738ec635520a508f7424a759261e5032cb0
-
SHA256
511c82313461b74fe24201d13dead6a280311d248062e09a465eb950502d1c18
-
SHA512
60e39f9628edbcb5118d53a2887c8f4879260d1d480a6a25960d58366fef2ca248b7115b521ff7de57c61063c1c35da0ac318fc22ad472b38b0cf34ecfd2534c
-
SSDEEP
6144:PGuqGuqGuqGuqGuqGuqGuqGuqGuqGuqGuVhG+qMh9c:xe
Static task
static1
Behavioral task
behavioral1
Sample
Bank Slip 2.rtf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Bank Slip 2.rtf
Resource
win10v2004-20240508-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.artefes.com - Port:
587 - Username:
[email protected] - Password:
ArtEfes4765*+
Targets
-
-
Target
Bank Slip 2.doc
-
Size
415KB
-
MD5
ff06a87dd0550386be1f780d560f1877
-
SHA1
69e95738ec635520a508f7424a759261e5032cb0
-
SHA256
511c82313461b74fe24201d13dead6a280311d248062e09a465eb950502d1c18
-
SHA512
60e39f9628edbcb5118d53a2887c8f4879260d1d480a6a25960d58366fef2ca248b7115b521ff7de57c61063c1c35da0ac318fc22ad472b38b0cf34ecfd2534c
-
SSDEEP
6144:PGuqGuqGuqGuqGuqGuqGuqGuqGuqGuqGuVhG+qMh9c:xe
-
Snake Keylogger payload
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-