Overview

overview

10

Static

static

PI-PRSS13T.exe

windows7-x64

1

PI-PRSS13T.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    PI-PRSS13T.exe

  • Size

    1016KB

  • Sample

    221012-ve8zmacda7

  • MD5

    f9200ab1cfa5e0eedd43218cee4950d5

  • SHA1

    d2e8b6fbf64c044103066ddb91e1f97f87e3e479

  • SHA256

    3077029e7ad5032ac31a547d76a7a4b8de9072616eed14123b7b2cb7d80d24d4

  • SHA512

    6b20fe02ecd9627a02435b38ea58773f82376701475a1f7c8b5827b93c49a66158c8f25e67b302a5f90a9d98d3ccd133d87bac52400aff295543792fee6371be

  • SSDEEP

    12288:c3JSO8dcUTNmfkI2GKPX4BqWLUSE2h7pChWcB/RUYO5MRLFZNCix1MJS0+5:c3J/fkNGg4BrUa+/RUV8zNCiTt0K

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      PI-PRSS13T.exe

    • Size

      1016KB

    • MD5

      f9200ab1cfa5e0eedd43218cee4950d5

    • SHA1

      d2e8b6fbf64c044103066ddb91e1f97f87e3e479

    • SHA256

      3077029e7ad5032ac31a547d76a7a4b8de9072616eed14123b7b2cb7d80d24d4

    • SHA512

      6b20fe02ecd9627a02435b38ea58773f82376701475a1f7c8b5827b93c49a66158c8f25e67b302a5f90a9d98d3ccd133d87bac52400aff295543792fee6371be

    • SSDEEP

      12288:c3JSO8dcUTNmfkI2GKPX4BqWLUSE2h7pChWcB/RUYO5MRLFZNCix1MJS0+5:c3J/fkNGg4BrUa+/RUV8zNCiTt0K

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks