Overview

overview

10

Static

static

Scan document.exe

windows7_x64

10

Scan document.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Scan document.exe

  • Size

    667KB

  • Sample

    210114-zkw9x9wt56

  • MD5

    3ae1b28cf2f2909ed5c5451653017a0a

  • SHA1

    726aaf44fb0761703f5044c858fe03644edc0063

  • SHA256

    218fa15ef4b6910a7dd996ed0b54df8dfae8f174013b4214971c91787654f7a4

  • SHA512

    3b133df737f66cfc8b54fd392a6b5a72a139e4f7d691ddd0674cecda5dd1cfaa2b583a1188bfad536318985ecb1f89d02fc778720b4ff19ba4b8cbfe8f4dfa0c

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    internationallove147

Targets

    • Target

      Scan document.exe

    • Size

      667KB

    • MD5

      3ae1b28cf2f2909ed5c5451653017a0a

    • SHA1

      726aaf44fb0761703f5044c858fe03644edc0063

    • SHA256

      218fa15ef4b6910a7dd996ed0b54df8dfae8f174013b4214971c91787654f7a4

    • SHA512

      3b133df737f66cfc8b54fd392a6b5a72a139e4f7d691ddd0674cecda5dd1cfaa2b583a1188bfad536318985ecb1f89d02fc778720b4ff19ba4b8cbfe8f4dfa0c

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger Payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks