Overview

overview

10

Static

static

Bank Swift.exe

windows7-x64

10

Bank Swift.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Bank Swift.exe

  • Size

    830KB

  • Sample

    221125-vcs6dsbd97

  • MD5

    aacbef36fa202e5eb1512c99022ef31c

  • SHA1

    97a12e69a35a037f34bbd4b4d779326bdb99ac7e

  • SHA256

    4d4be5a0fb152cb0f795f6ce36b1b3e4e69234681e36c41f3760858b4d38aa31

  • SHA512

    5648dbe1a6c3f6aef53b1c14ba50b3837c2671a00934a0c3049d31711b6e61f972b2d7b1b3531ea6db671e0a22ec208759e1aa0547ce5cf4e906a201756dc84a

  • SSDEEP

    24576:Cw/HDtU376CVtv1ekon6imVSE/HHkFg/IyXtrpc:o3tv1jftfkoXVp

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot1644755040:AAGRTnph6BdO8-t1bJaOyVu9aeuJErmisqs/sendMessage?chat_id=1637651323

Targets

    • Target

      Bank Swift.exe

    • Size

      830KB

    • MD5

      aacbef36fa202e5eb1512c99022ef31c

    • SHA1

      97a12e69a35a037f34bbd4b4d779326bdb99ac7e

    • SHA256

      4d4be5a0fb152cb0f795f6ce36b1b3e4e69234681e36c41f3760858b4d38aa31

    • SHA512

      5648dbe1a6c3f6aef53b1c14ba50b3837c2671a00934a0c3049d31711b6e61f972b2d7b1b3531ea6db671e0a22ec208759e1aa0547ce5cf4e906a201756dc84a

    • SSDEEP

      24576:Cw/HDtU376CVtv1ekon6imVSE/HHkFg/IyXtrpc:o3tv1jftfkoXVp

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks