Overview

overview

10

Static

static

PO#120111.exe

windows7_x64

10

PO#120111.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO#120111.exe

  • Size

    705KB

  • Sample

    220520-15mf7shggn

  • MD5

    308d21fc3085301ae679fdc305be6a7a

  • SHA1

    10e700444d2ca58f75681953bb1a1bbb59dfb498

  • SHA256

    c2186fd9dedfc7f90be64b895c2ce0ce93ae347b99de534bfc9570f9f9ad80e7

  • SHA512

    984cdecca9c6dbeafa319029242ae9d5a08ce1bb38e8e612580ff96c1cd069159dc624335b33999a8e55b84e4027c7e1e96f50db4b4d90938303409f97816d45

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      PO#120111.exe

    • Size

      705KB

    • MD5

      308d21fc3085301ae679fdc305be6a7a

    • SHA1

      10e700444d2ca58f75681953bb1a1bbb59dfb498

    • SHA256

      c2186fd9dedfc7f90be64b895c2ce0ce93ae347b99de534bfc9570f9f9ad80e7

    • SHA512

      984cdecca9c6dbeafa319029242ae9d5a08ce1bb38e8e612580ff96c1cd069159dc624335b33999a8e55b84e4027c7e1e96f50db4b4d90938303409f97816d45

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger Payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks