Overview

overview

10

Static

static

3

REQUEST FO...F2.exe

windows7-x64

10

REQUEST FO...F2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    49c59a32e93fef5738e0391500ed7bee421897016304d6db4cb58d9dd1c6d996

  • Size

    488KB

  • Sample

    231012-vennpaeg67

  • MD5

    abe71b76532b0ef4a0dfac4b30657931

  • SHA1

    ca9cb16c67a50036e221ef399a4716973a869d26

  • SHA256

    49c59a32e93fef5738e0391500ed7bee421897016304d6db4cb58d9dd1c6d996

  • SHA512

    ad5cf04bb267613b5dd4e31e3399263819cac16aea2a44725ec3df94447f584821d71033f99682c8d75428f9c45d466b137dd828c3085dddb9107680c415d9b1

  • SSDEEP

    12288:+JLN9IFbCVzKBJbuNQvSq15HY5LsiGNWg:GgIFKoQPM5Lsi2Wg

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      REQUEST FOR QUOTATION E230830F2.exe

    • Size

      560KB

    • MD5

      5bef2b26267e7cfbc2d8c02404627ccd

    • SHA1

      8ee2fe6bb21ff176100bc9403e060a4aa2021403

    • SHA256

      de3b0df29cca773ff488c9e27f051b767fa7bd93ae9fedd5db91037de48615ca

    • SHA512

      386bf359c6c6acc6ea0071c24efd7f1beea3930c1c2045c0c6c71fd1f8f2ca1caeb1506c1c0aca24abe022c7ad061a3d1a5531aa74b52f9578f931ffa0aad6fe

    • SSDEEP

      12288:kY2AfDuHOXDAMfAkcOJJy5CoKHLw+wEcryuleCWp8N7:kY2gxf2OXy5CoCLJwyule

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks