Overview

overview

10

Static

static

3

KVC PO1100538819.exe

windows7-x64

10

KVC PO1100538819.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    KVC PO1100538819.exe

  • Size

    732KB

  • Sample

    230802-kpv6eaeg9t

  • MD5

    4fb089125b75694036d39124584c0374

  • SHA1

    0ce940199d1da05f9ce9834bf831be7b4fea0562

  • SHA256

    7e961fe6e69522736f067afa59213ed1fe4118a470c9cf272cf15189ff47bf7a

  • SHA512

    fe2eb29efa6eef24f266e3e930e689f79a7289e6a005f297b4ef501656c966d407ed17af93c2c11e2b156157d8bbc1f9568eccdb2233280924ffa0122bf514f0

  • SSDEEP

    12288:R5MYqIHkdbQKPX7VtiVL8B5rRNH36hVCG+/HSQTibBJTS73Sv:R6hQkdbvpqL8/9NX6HCG6HSQTp7

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Targets

    • Target

      KVC PO1100538819.exe

    • Size

      732KB

    • MD5

      4fb089125b75694036d39124584c0374

    • SHA1

      0ce940199d1da05f9ce9834bf831be7b4fea0562

    • SHA256

      7e961fe6e69522736f067afa59213ed1fe4118a470c9cf272cf15189ff47bf7a

    • SHA512

      fe2eb29efa6eef24f266e3e930e689f79a7289e6a005f297b4ef501656c966d407ed17af93c2c11e2b156157d8bbc1f9568eccdb2233280924ffa0122bf514f0

    • SSDEEP

      12288:R5MYqIHkdbQKPX7VtiVL8B5rRNH36hVCG+/HSQTibBJTS73Sv:R6hQkdbvpqL8/9NX6HCG6HSQTp7

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Uses the VBS compiler for execution

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks