Overview

overview

10

Static

static

9

POL 495.exe

windows7_x64

10

POL 495.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    POL 495.exe

  • Size

    575KB

  • Sample

    210129-nwy935a892

  • MD5

    3e8d7d953385247857ff9800b08c71fa

  • SHA1

    4d40b4b61bfda3f6c2d560f69259ec27d5f3b06a

  • SHA256

    a8aad152f516add6a277e2634baa324b105a90c3b02935aa2fa11ea4f0c4667e

  • SHA512

    0e7f75494177f706299ce5d947a26557e8c1320bed6c003b1daf87da5bb676bcdea3fb26ed57d9765054574caf91c279b0d0b7456a1cdce93613b3f08a39c620

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Targets

    • Target

      POL 495.exe

    • Size

      575KB

    • MD5

      3e8d7d953385247857ff9800b08c71fa

    • SHA1

      4d40b4b61bfda3f6c2d560f69259ec27d5f3b06a

    • SHA256

      a8aad152f516add6a277e2634baa324b105a90c3b02935aa2fa11ea4f0c4667e

    • SHA512

      0e7f75494177f706299ce5d947a26557e8c1320bed6c003b1daf87da5bb676bcdea3fb26ed57d9765054574caf91c279b0d0b7456a1cdce93613b3f08a39c620

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger Payload

    • Beds Protector Packer

      Detects Beds Protector packer used to load .NET malware.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks