Overview

overview

10

Static

static

Zasneipp.exe

windows7-x64

10

Zasneipp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Zasneipp.exe

  • Size

    7KB

  • Sample

    230201-rvqw7sca2s

  • MD5

    c035e1bc5f37c474441db456d903eea0

  • SHA1

    bc6992a6e31b6d67b6732c142ec47bebde49fee1

  • SHA256

    84e348e49442b996738cb0d3d4fcd275e3db781fe805045e139736d9eeeca695

  • SHA512

    845f22b8b4f6a75d96f63e5546c7f719de57d54b4f15a9789f4156e1156fb6fbe54d61aded8da54a1ef0e8e2d9e55192f18ee032d43d1f2c6c5fd675a3150373

  • SSDEEP

    96:iUBTdcgDszgY1KsXrXhRQYYB3Tt4BtEkdexegbFnU:iUBhUdRQYYFGzAkZ

Score
10/10
purecryptersnakekeyloggercollectiondownloaderkeyloggerloaderstealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5824924248:AAF4WKjJ8FxpNsC2HwCM114EP_g8rFkC4wQ/sendMessage?chat_id=2054148913

Targets

    • Target

      Zasneipp.exe

    • Size

      7KB

    • MD5

      c035e1bc5f37c474441db456d903eea0

    • SHA1

      bc6992a6e31b6d67b6732c142ec47bebde49fee1

    • SHA256

      84e348e49442b996738cb0d3d4fcd275e3db781fe805045e139736d9eeeca695

    • SHA512

      845f22b8b4f6a75d96f63e5546c7f719de57d54b4f15a9789f4156e1156fb6fbe54d61aded8da54a1ef0e8e2d9e55192f18ee032d43d1f2c6c5fd675a3150373

    • SSDEEP

      96:iUBTdcgDszgY1KsXrXhRQYYB3Tt4BtEkdexegbFnU:iUBhUdRQYYFGzAkZ

    Score
    10/10
    purecryptersnakekeyloggercollectiondownloaderkeyloggerloaderstealer

    • Detect PureCrypter injector

      loader

    • PureCrypter

      PureCrypter is a .NET malware loader first seen in early 2021.

      loaderdownloaderpurecrypter

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks