Overview

overview

10

Static

static

9

PURCHASE ORDER..exe

windows7_x64

10

PURCHASE ORDER..exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PURCHASE ORDER..exe

  • Size

    576KB

  • Sample

    210131-jyy68p69gj

  • MD5

    cb25a59de77f8d5572a8994d0b911fa4

  • SHA1

    11ecb06e2b95e8d07282cccf8335990f7fe79b7e

  • SHA256

    ee049ddb16bce4b0a37cce581802976cb696243207172c8461ba27d85948fd5e

  • SHA512

    8ac689e304d8989941f8402d26d75d0dee88ee1837715318a43f14e6a545e6e038041f521c63dd5fa11cf9fb6b901f75b48d7b6f516c13e57c2b9fd6569ad5b3

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Targets

    • Target

      PURCHASE ORDER..exe

    • Size

      576KB

    • MD5

      cb25a59de77f8d5572a8994d0b911fa4

    • SHA1

      11ecb06e2b95e8d07282cccf8335990f7fe79b7e

    • SHA256

      ee049ddb16bce4b0a37cce581802976cb696243207172c8461ba27d85948fd5e

    • SHA512

      8ac689e304d8989941f8402d26d75d0dee88ee1837715318a43f14e6a545e6e038041f521c63dd5fa11cf9fb6b901f75b48d7b6f516c13e57c2b9fd6569ad5b3

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger Payload

    • Beds Protector Packer

      Detects Beds Protector packer used to load .NET malware.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks