Overview

overview

10

Static

static

fishcom2021,2022.exe

windows7-x64

10

fishcom2021,2022.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fishcom2021,2022.zip

  • Size

    428KB

  • Sample

    221018-h13nhsehb5

  • MD5

    d92d722bb448707226a238747a3f6ba4

  • SHA1

    efc809f6858a3c468aa518d17a619229d0999b6f

  • SHA256

    53947d3249013c415585a4bd2ed6f31415f98fa69d50e1720d13c381157a75d4

  • SHA512

    b00354a9be5a6f79867f5f661ed4cc5568a069da2b9878468f433c5566bef44589a2b6e8eb517c5e45e93d936c98d58b556055fb7da64c2f5b68bc82d45e7933

  • SSDEEP

    12288:Q7evVWHTHt/hP+Cki1wcbfrv/mhqUXkSStUDkAb6fgRsw:Q7CVWHps0TryXIMkwyw

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5495243543:AAG3XPeGW7yqfXF6_EXjGSfO9SWHJTpqVsU/sendMessage?chat_id=1128973051

Targets

    • Target

      fishcom2021,2022.exe

    • Size

      523KB

    • MD5

      424fe253270dbe031875b067634575e7

    • SHA1

      94b9e195ccd190243f01e8370f640bf3fee30791

    • SHA256

      2395d7c0f0f0a4034de2b9371519d95ca14bbb81d74afdd44111a1a5eb7497d6

    • SHA512

      b47327a18ed3ee69928885f09c60b2f1d935e64ddfd7c2426932f8ad168cbedd077aa7cb42c8e4bbaaa518b5f3a7bf2ab81e32e79afd72082f46ee5bc7678f1a

    • SSDEEP

      12288:R2o+Wxx9D/h5+CKi1web3rH5mhOUhM2llGytUDkAOb:f+Wxri+LrK5lZMkJ

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks