Overview

overview

10

Static

static

090000009009.exe

windows7_x64

10

090000009009.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    090000009009.exe

  • Size

    833KB

  • Sample

    210121-xhj8ps5kqn

  • MD5

    971e6106de288df8941717950c47246f

  • SHA1

    8e3a11a580fe8ec92b248cddff95da83bbe47945

  • SHA256

    a34a8d989da203aeba58a9e077a12ae65da172bd5635d6ec112f49411a5f29a5

  • SHA512

    52eff3720ff3ba180a0e357b99fcd4270a8a638a6950f06c9d5735a53593e4d094d976876ae4255fc98ef83b3199068641cf443281d7b0aad22c1bd085fbb20f

Score
10/10
snakekeyloggerkeyloggerransomwarestealer

Malware Config

Targets

    • Target

      090000009009.exe

    • Size

      833KB

    • MD5

      971e6106de288df8941717950c47246f

    • SHA1

      8e3a11a580fe8ec92b248cddff95da83bbe47945

    • SHA256

      a34a8d989da203aeba58a9e077a12ae65da172bd5635d6ec112f49411a5f29a5

    • SHA512

      52eff3720ff3ba180a0e357b99fcd4270a8a638a6950f06c9d5735a53593e4d094d976876ae4255fc98ef83b3199068641cf443281d7b0aad22c1bd085fbb20f

    Score
    10/10
    snakekeyloggerkeyloggerransomwarestealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger Payload

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

      ransomware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks