Overview

overview

10

Static

static

9

Agent Stat...ro.exe

windows7_x64

10

Agent Stat...ro.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Agent Statement CargoPro.exe

  • Size

    576KB

  • Sample

    210130-flhkr7hqna

  • MD5

    b4bce8a85b776b3aadb064547eaff482

  • SHA1

    87d05af272cef33d6bdd96acb3f2c6f34c5a1130

  • SHA256

    a821247cfbed9095b7e7686eeca6572b9e506e080861c11c25be542f163a2500

  • SHA512

    08c7dc539f9e435d597248b7b38af30c9df6b8e2e291ceb4fb969295f73ac64aa19a394cdc44dbd62bfc5d21cd7cd6a6806b0e69eb912656f37ea3b5f8109303

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Targets

    • Target

      Agent Statement CargoPro.exe

    • Size

      576KB

    • MD5

      b4bce8a85b776b3aadb064547eaff482

    • SHA1

      87d05af272cef33d6bdd96acb3f2c6f34c5a1130

    • SHA256

      a821247cfbed9095b7e7686eeca6572b9e506e080861c11c25be542f163a2500

    • SHA512

      08c7dc539f9e435d597248b7b38af30c9df6b8e2e291ceb4fb969295f73ac64aa19a394cdc44dbd62bfc5d21cd7cd6a6806b0e69eb912656f37ea3b5f8109303

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger Payload

    • Beds Protector Packer

      Detects Beds Protector packer used to load .NET malware.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks