Overview

overview

10

Static

static

Agent99.exe

windows7_x64

10

Agent99.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Agent99.exe

  • Size

    220KB

  • Sample

    220704-jbs88ahdg4

  • MD5

    bb56a5ff6280b1f94386c8b116c0e4f3

  • SHA1

    2dd2f5781b6b3222ed5fab971783c98befee151c

  • SHA256

    744c3903223bec0dfab7e1ddc7faaeb4989bbe1399a4047f75883c18063b676f

  • SHA512

    cc99dd2046c2858f4090e6faa65c53b1c62cb4cbea6f81766215d8ebf4316a03e1b1eef798d1f5fbd865b26f7d687d0fd9f5bcbee6ff6157584f1d08b06f4f95

Score
10/10
snakekeyloggercollectionkeyloggerpersistencestealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot1836400811:AAHbceSsBewgu2-18DdhyOIr5kwyIr-_36E/sendMessage?chat_id=-565678976

Targets

    • Target

      Agent99.exe

    • Size

      220KB

    • MD5

      bb56a5ff6280b1f94386c8b116c0e4f3

    • SHA1

      2dd2f5781b6b3222ed5fab971783c98befee151c

    • SHA256

      744c3903223bec0dfab7e1ddc7faaeb4989bbe1399a4047f75883c18063b676f

    • SHA512

      cc99dd2046c2858f4090e6faa65c53b1c62cb4cbea6f81766215d8ebf4316a03e1b1eef798d1f5fbd865b26f7d687d0fd9f5bcbee6ff6157584f1d08b06f4f95

    Score
    10/10
    snakekeyloggercollectionkeyloggerpersistencestealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks