Overview

overview

10

Static

static

3

Signed PO.exe

windows7-x64

10

Signed PO.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9add486013a4b4aff938360e0f5b4627fd13a8284ba001c875be58be7e66cc26

  • Size

    498KB

  • Sample

    231206-dymgasag72

  • MD5

    1352f55a77a8bb98d38cd471bed85154

  • SHA1

    a70a9cb3d5d35de835efa8f2edab9ed6e8bf7c48

  • SHA256

    9add486013a4b4aff938360e0f5b4627fd13a8284ba001c875be58be7e66cc26

  • SHA512

    44789bfea5573b9e9b00547cbbf790b0d8b7d67fa9773c7371d75b010e024402f99c897a5ad72086ba110f585ade2dffdc2389561152264156769c6628f3675e

  • SSDEEP

    12288:u51EVrfyOYFNs3QkbAoxi6Kb5VRPDu1qjGLej2I:UWmOYNsbAoMryYtjX

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Targets

    • Target

      Signed PO.exe

    • Size

      530KB

    • MD5

      1e9bd17b41b3d22d9f1d0ede3af18439

    • SHA1

      37cbc2fc2bb09be167af47fd22a5f51d1be73383

    • SHA256

      9a14222cf7f17d59fc5c4a1eff5fbfd662bf4d42c6355258d10e25c8f4ff8f2f

    • SHA512

      06905c18205bdfa87eb73fe050177e915502295952fd70f73edb5b258842c953b41afc18187a2370a0bd92561438dbccc74655b595e38ba3c34add9bcf462764

    • SSDEEP

      12288:KmPQaueH5qMz95lgBCDAjAFLExSdyw3xodJMqFVVU7kFtSCsqhKpkKlxdVx2:KmNqMz95OcDqAaEcFVMuACFirdVx

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks