Overview

overview

10

Static

static

9

payment status.exe

windows7_x64

10

payment status.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    payment status.exe

  • Size

    586KB

  • Sample

    210131-9xh6nqsr12

  • MD5

    f0b5aa17657d3f28219d4c4bf6d4e20d

  • SHA1

    f61c0d49ca1d1894d4abe55ab7efd236db74899c

  • SHA256

    71908b2defae460e3fef4b3275a66680bb518a59a8b0d740e61f063ff9eece45

  • SHA512

    e26415e49f4449d197969316431d8f097c6fe9d621498a86bcc98e55efdcfc364d7ba38b62a9c56f81fc29491e94d60e29d3697456c4d68141f257c2e06e2296

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Targets

    • Target

      payment status.exe

    • Size

      586KB

    • MD5

      f0b5aa17657d3f28219d4c4bf6d4e20d

    • SHA1

      f61c0d49ca1d1894d4abe55ab7efd236db74899c

    • SHA256

      71908b2defae460e3fef4b3275a66680bb518a59a8b0d740e61f063ff9eece45

    • SHA512

      e26415e49f4449d197969316431d8f097c6fe9d621498a86bcc98e55efdcfc364d7ba38b62a9c56f81fc29491e94d60e29d3697456c4d68141f257c2e06e2296

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger Payload

    • Beds Protector Packer

      Detects Beds Protector packer used to load .NET malware.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks