Overview
overview
10Static
static
10SnakeKeylo...LI.exe
windows7-x64
3SnakeKeylo...LI.exe
windows10-2004-x64
3SnakeKeylo...er.exe
windows7-x64
1SnakeKeylo...er.exe
windows10-2004-x64
1SnakeKeylo...le.exe
windows7-x64
1SnakeKeylo...le.exe
windows10-2004-x64
1SnakeKeylo...es.exe
windows7-x64
1SnakeKeylo...es.exe
windows10-2004-x64
1SnakeKeylo...er.exe
windows7-x64
10SnakeKeylo...er.exe
windows10-2004-x64
10SnakeKeylo...st.exe
windows7-x64
3SnakeKeylo...st.exe
windows10-2004-x64
3SnakeKeylo...er.exe
windows7-x64
10SnakeKeylo...er.exe
windows10-2004-x64
10SnakeKeylo...st.exe
windows7-x64
3SnakeKeylo...st.exe
windows10-2004-x64
3SnakeKeylo...er.exe
windows7-x64
10SnakeKeylo...er.exe
windows10-2004-x64
10SnakeKeylo...er.exe
windows7-x64
10SnakeKeylo...er.exe
windows10-2004-x64
10Analysis
-
max time kernel
95s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2023, 03:44
Behavioral task
behavioral1
Sample
SnakeKeylogger-main/Resources/Confuser_CLI.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
SnakeKeylogger-main/Resources/Confuser_CLI.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
SnakeKeylogger-main/Resources/KoiVM_Confuser.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
SnakeKeylogger-main/Resources/KoiVM_Confuser.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral5
Sample
SnakeKeylogger-main/Resources/Obfuscar_Console.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
SnakeKeylogger-main/Resources/Obfuscar_Console.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
SnakeKeylogger-main/Resources/Res.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
SnakeKeylogger-main/Resources/Res.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
SnakeKeylogger-main/bin/Debug/Snake Keylogger.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
SnakeKeylogger-main/bin/Debug/Snake Keylogger.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
SnakeKeylogger-main/bin/Debug/Snake Keylogger.vshost.exe
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
SnakeKeylogger-main/bin/Debug/Snake Keylogger.vshost.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
SnakeKeylogger-main/bin/Release/Snake Keylogger.exe
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
SnakeKeylogger-main/bin/Release/Snake Keylogger.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
SnakeKeylogger-main/bin/Release/Snake Keylogger.vshost.exe
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
SnakeKeylogger-main/bin/Release/Snake Keylogger.vshost.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
SnakeKeylogger-main/obj/Debug/Snake Keylogger.exe
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
SnakeKeylogger-main/obj/Debug/Snake Keylogger.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
SnakeKeylogger-main/obj/Release/Snake Keylogger.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
SnakeKeylogger-main/obj/Release/Snake Keylogger.exe
Resource
win10v2004-20230220-en
General
-
Target
SnakeKeylogger-main/bin/Release/Snake Keylogger.exe
-
Size
6.0MB
-
MD5
7d9c8e2d6d6bf957a1ebda127c084652
-
SHA1
2ff3951d6b5113902fde10f484d31b8d35912baf
-
SHA256
fd6e3c0c6a443a9872a082f02955ca8cf7bc7f42752fdc0fe01622a5d35d07bf
-
SHA512
cda06d41880d1b23f086bfbec0fe19f3cd787b1fdd0e2d4a8f80747fb42b088ed7cbc456f8862b979b7c94b5f0ba313749797f998867fccf17482d947860c933
-
SSDEEP
49152:Hus/0tGxAPbN34EG1nFCiQ9bozruSX0RIglO1CuL9VNcaCdGczKITh1fk1gkLF:Os0tGx7K6rt6MpChJCj
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
resource yara_rule behavioral14/memory/1304-133-0x0000000000BC0000-0x00000000011C4000-memory.dmp family_snakekeylogger -
Beds Protector Packer 1 IoCs
Detects Beds Protector packer used to load .NET malware.
resource yara_rule behavioral14/memory/1304-133-0x0000000000BC0000-0x00000000011C4000-memory.dmp beds_protector