Overview

overview

10

Static

static

3

1ab6ad1baf...fd.exe

windows7-x64

10

1ab6ad1baf...fd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1ab6ad1baf7099b79f78d5cc575dc08d33320b1f607b6fa038432c3a27fb2dfd.exe

  • Size

    609KB

  • Sample

    231202-llw4zabe2w

  • MD5

    fe03b712d2e463fdeb67f9f9f2d98fc9

  • SHA1

    d978aed329e47d47791e13f31fc4aa823e545f89

  • SHA256

    1ab6ad1baf7099b79f78d5cc575dc08d33320b1f607b6fa038432c3a27fb2dfd

  • SHA512

    170ca520c7a9489f8245ae18fb3fa5aa7bc1441d183daa4f72e34a3bbbd393ca46427c25a3809fd805c19348eebf880f1b51c4c147b0ddeac8f1aad02fcd3a03

  • SSDEEP

    12288:hMdIt/5J/tXcPl1RWLDmJr4YoKnE5ZrZ4YIfjwIF7:iWBJZ0lSuEbT5ZrlI7ws7

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Targets

    • Target

      1ab6ad1baf7099b79f78d5cc575dc08d33320b1f607b6fa038432c3a27fb2dfd.exe

    • Size

      609KB

    • MD5

      fe03b712d2e463fdeb67f9f9f2d98fc9

    • SHA1

      d978aed329e47d47791e13f31fc4aa823e545f89

    • SHA256

      1ab6ad1baf7099b79f78d5cc575dc08d33320b1f607b6fa038432c3a27fb2dfd

    • SHA512

      170ca520c7a9489f8245ae18fb3fa5aa7bc1441d183daa4f72e34a3bbbd393ca46427c25a3809fd805c19348eebf880f1b51c4c147b0ddeac8f1aad02fcd3a03

    • SSDEEP

      12288:hMdIt/5J/tXcPl1RWLDmJr4YoKnE5ZrZ4YIfjwIF7:iWBJZ0lSuEbT5ZrlI7ws7

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks