Overview

overview

10

Static

static

3

16f9ece070...38.exe

windows7-x64

10

16f9ece070...38.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.zip

  • Size

    296KB

  • Sample

    231022-vkzcdabc61

  • MD5

    40fd295e8ecec60649d26188591096ec

  • SHA1

    be3570d81609d929b94e7192d92f9205a0b2f153

  • SHA256

    76a7f3ea3965896cf16bc921fc73a4d3a85abb7a80125ba29e3c1088a4ae4d15

  • SHA512

    d83ffdf271b59a36326c8a716c160b68bb1c57c95093a5f9272a344967f46a256ceaf5a9c940b6c334b7d621765ceb0ee55a450a6736564b554f9d92232c60cc

  • SSDEEP

    6144:TuQxzc00XC6dXnWF0NocEm9e52tNk3ZoHqqwbm7iVQzOV/:SQlOdXC0Nv1JtmJV/

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6243209595:AAGECSmdSqJiVZcdFoBvotoaKcKT9Lz5Gvw/sendMessage?chat_id=1070926352

Targets

    • Target

      16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe

    • Size

      366KB

    • MD5

      3c1ade1441ef11aed8496b742eab197b

    • SHA1

      06ebde82c367791c03196888fb2fcc7721296564

    • SHA256

      16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738

    • SHA512

      79f35c1f552040fd3f5273aa288bbcc86662a325dc9fd5c1817d127568a5edd3337c9b124583c3e09d07c446dcdc2b6b515227ec0d987b6b8444f342046715a6

    • SSDEEP

      6144:L0nJBIKD2SJMz2dR8rZNlvzGSTo5xBB9VVh8YZWUBwDPlj3y4QTdk6ceh9X3P92D:sJfD2S+nRqx39Xh88VBIlzy4Qpk6ceXx

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks