General

  • Target

    1264d9a78e0a24ec6f515b25b1a83a39d9091ec109d07115daaf17afc16eb756exe_JC.exe

  • Size

    363KB

  • Sample

    230731-lcgypadh95

  • MD5

    3e00f2882854b005a81025ce13629ed0

  • SHA1

    017aaab67646c5acccd658eb9d9d8f1955c009e3

  • SHA256

    1264d9a78e0a24ec6f515b25b1a83a39d9091ec109d07115daaf17afc16eb756

  • SHA512

    baad729ad76361d90480741fda1cc73d6ae25db60fdd0d22b7425b7b86021b05a05961050460250c222271c8ecdaec22d2c18f8096aac24a115d717122e38204

  • SSDEEP

    6144:X8LxBsbFt9Y14A+mTbFaX5XUm81F9lE5so+2fB4Xz1i1Fl4Ast3fGhkMWLD+Xh6c:N4+mTbQXVUmIm5pqSv4AEPGhkMCGgO

Malware Config

Targets

    • Target

      1264d9a78e0a24ec6f515b25b1a83a39d9091ec109d07115daaf17afc16eb756exe_JC.exe

    • Size

      363KB

    • MD5

      3e00f2882854b005a81025ce13629ed0

    • SHA1

      017aaab67646c5acccd658eb9d9d8f1955c009e3

    • SHA256

      1264d9a78e0a24ec6f515b25b1a83a39d9091ec109d07115daaf17afc16eb756

    • SHA512

      baad729ad76361d90480741fda1cc73d6ae25db60fdd0d22b7425b7b86021b05a05961050460250c222271c8ecdaec22d2c18f8096aac24a115d717122e38204

    • SSDEEP

      6144:X8LxBsbFt9Y14A+mTbFaX5XUm81F9lE5so+2fB4Xz1i1Fl4Ast3fGhkMWLD+Xh6c:N4+mTbQXVUmIm5pqSv4AEPGhkMCGgO

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks