Overview

overview

10

Static

static

63b1a4c132...6f.exe

windows7_x64

10

63b1a4c132...6f.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    63b1a4c132a3548417961c472caa826f
  • Size 567KB
  • Sample220330-gw2d8adcdp
  • SHA256 0a67ff35add751a754db8f7d55515b0dbac034b87274cfd1cc351f7679a98b2f
  • MD5 SHA1 SHA512
Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Targets

    • Target
      63b1a4c132a3548417961c472caa826f
    • Size 567KB
    • SHA256 0a67ff35add751a754db8f7d55515b0dbac034b87274cfd1cc351f7679a98b2f
    • MD5 SHA1 SHA512
    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks