Overview

overview

10

Static

static

3

PO ISI2319.exe

windows7-x64

10

PO ISI2319.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6bd869b7ff4da9523cecbacc4366c6ee94b2f049d3aa88619e96a1a7ecae71ec

  • Size

    496KB

  • Sample

    231129-fnkwtsed9s

  • MD5

    e34e35691af0b33d883db08833fd2e9c

  • SHA1

    39e12667d9cef24e5d6f891ea8d8109899c925b4

  • SHA256

    6bd869b7ff4da9523cecbacc4366c6ee94b2f049d3aa88619e96a1a7ecae71ec

  • SHA512

    1562d6389acc4eef138d83f267040c31a5971e85fbb446a8b0fad15a7fe78578133d034fa578540e2a20a6e82fcd58a344763f85181c6be4d99e1a698bd54c21

  • SSDEEP

    12288:r4OTuxZpe1dvB3vyhh3wnrCdpauKyVFxAwLT1bQSZOj:rni7sdp/yhlwnrYguK4CITdQic

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      PO ISI2319.exe

    • Size

      578KB

    • MD5

      1b4fff675df6cd7b8256b9530d9f2da0

    • SHA1

      00e4ceab35ba0ef12a44f560ede6a61d4206619c

    • SHA256

      095874a28fb610214b5f0e2cb00246f160d6dfd3eaf8c8a033226e4266668374

    • SHA512

      faf119858a053016c038e34d259c74fc730095ca687b7324f8f27fadeac6837034fe07b17f9df66e2a568027e6f525435ce18699703e2d76ba3647966f73ad98

    • SSDEEP

      12288:YSncopox4xI1R3r65/aqqLWmeEs2KF36rS3rpf4w6aOmdx:YeF8Fr6b4WmeYuB4w6Rmdx

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks