Overview

overview

10

Static

static

3

purchase order.exe

windows7-x64

10

purchase order.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6a94e94a67e0bccae5b00f6b3eda454555dc40f07f5aaed982876a5645be423d

  • Size

    496KB

  • Sample

    231129-ejfwmseb98

  • MD5

    b21e21e9c2d1310e7610aeffe699ba34

  • SHA1

    a33b1a60c6fdda7589cd090fc72ef487d0a04cd4

  • SHA256

    6a94e94a67e0bccae5b00f6b3eda454555dc40f07f5aaed982876a5645be423d

  • SHA512

    6a0a4b65a2a26543c25efbedfb4311ab6b24cb3f6784d8948bf0c3ef5f0405c5e96fbede5abe106e8eca0ee211013f2b110dd73e08ab75989eb259147f6f79d0

  • SSDEEP

    12288:94OTuxZpe1dvB3vyhh3wnrCdpauKyVFxAwLT1bQSZOj:9ni7sdp/yhlwnrYguK4CITdQic

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      purchase order.exe

    • Size

      578KB

    • MD5

      1b4fff675df6cd7b8256b9530d9f2da0

    • SHA1

      00e4ceab35ba0ef12a44f560ede6a61d4206619c

    • SHA256

      095874a28fb610214b5f0e2cb00246f160d6dfd3eaf8c8a033226e4266668374

    • SHA512

      faf119858a053016c038e34d259c74fc730095ca687b7324f8f27fadeac6837034fe07b17f9df66e2a568027e6f525435ce18699703e2d76ba3647966f73ad98

    • SSDEEP

      12288:YSncopox4xI1R3r65/aqqLWmeEs2KF36rS3rpf4w6aOmdx:YeF8Fr6b4WmeYuB4w6Rmdx

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks