Overview

overview

10

Static

static

3

PRICE PI.exe

windows7-x64

10

PRICE PI.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cc0fa4584d4cae4d4d0582c499eb3b3e7521f0d3d25e4d0c052d6643eb2cafa6

  • Size

    496KB

  • Sample

    231129-em7tjaec52

  • MD5

    6660bad52960f2252b73bb2449cedb52

  • SHA1

    e86f8fde0db99eb48b19a982826636798a58031b

  • SHA256

    cc0fa4584d4cae4d4d0582c499eb3b3e7521f0d3d25e4d0c052d6643eb2cafa6

  • SHA512

    ba69ab6cc0b2f97c695b69b71c0f1b2bdc4dff1d52d26a0925f98f7179352c2f9c52a0a6a176cb1cd4dbf6c11c01c4a5341bc3f3b774f4276fdc9642cd4ce202

  • SSDEEP

    12288:H4OTuxZpe1dvB3vyhh3wnrCdpauKyVFxAwLT1bQSZOj:Hni7sdp/yhlwnrYguK4CITdQic

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      PRICE PI.exe

    • Size

      578KB

    • MD5

      1b4fff675df6cd7b8256b9530d9f2da0

    • SHA1

      00e4ceab35ba0ef12a44f560ede6a61d4206619c

    • SHA256

      095874a28fb610214b5f0e2cb00246f160d6dfd3eaf8c8a033226e4266668374

    • SHA512

      faf119858a053016c038e34d259c74fc730095ca687b7324f8f27fadeac6837034fe07b17f9df66e2a568027e6f525435ce18699703e2d76ba3647966f73ad98

    • SSDEEP

      12288:YSncopox4xI1R3r65/aqqLWmeEs2KF36rS3rpf4w6aOmdx:YeF8Fr6b4WmeYuB4w6Rmdx

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks