Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    327KB

  • Sample

    231026-k6q8saeh86

  • MD5

    b32777ec3e6822e6de38fd54a813f179

  • SHA1

    dcf73ce955dbbbc34b132d7c224c871266daf4fd

  • SHA256

    1700e539cd41c00e4b3b8b4405ee0bf338192f0b24836939e14f8b9d2c6bd9f4

  • SHA512

    d8069e88cd701bde4bc623d8466f8eea46d6e5c17ab9c91472219de4e33f7d52c531050dca659a25fc7a448a7fa8b19a5240a9b27ab03d1db75c9eec282c4dab

  • SSDEEP

    6144:CeOazRkjEMgrtPJhz9HLAuTQfc/VsKQqeYOtYYE2Odtyqd72f6QD:CeOazsIPD9Au5qWZlYrOiqod

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.hahcd.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    d5ClGOqbU6HU

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      file.exe

    • Size

      327KB

    • MD5

      b32777ec3e6822e6de38fd54a813f179

    • SHA1

      dcf73ce955dbbbc34b132d7c224c871266daf4fd

    • SHA256

      1700e539cd41c00e4b3b8b4405ee0bf338192f0b24836939e14f8b9d2c6bd9f4

    • SHA512

      d8069e88cd701bde4bc623d8466f8eea46d6e5c17ab9c91472219de4e33f7d52c531050dca659a25fc7a448a7fa8b19a5240a9b27ab03d1db75c9eec282c4dab

    • SSDEEP

      6144:CeOazRkjEMgrtPJhz9HLAuTQfc/VsKQqeYOtYYE2Odtyqd72f6QD:CeOazsIPD9Au5qWZlYrOiqod

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks