Overview

overview

10

Static

static

3

2b1679e8ba...9e.exe

windows7-x64

10

2b1679e8ba...9e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2b1679e8ba0a15c211922ced9909c89e

  • Size

    563KB

  • Sample

    231231-gsm3esdgb7

  • MD5

    2b1679e8ba0a15c211922ced9909c89e

  • SHA1

    e1ea8f4ecd4b01f87275d3bd13c101facfbe9408

  • SHA256

    70351038cf49fc5bf127e4f7df1c563ec036293cbc00010ade2364e0ee311a27

  • SHA512

    924c86ab4eacb6db3a3327ba493e1fecd21c513335decd114b6e028ae2f29ad2be5549d6857afbd56203ffd05b0582682f41aeb6f3ed2a5254badbac663d5da9

  • SSDEEP

    12288:3FtowDCyEzuRczAeqUA+NWySj8uWXzx7yVfP4dcV7XiQVyQ7mo5oFCEkv:3Fto4CyEPsUnNW8Jm5PqcVj7mo5oFCEa

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Targets

    • Target

      2b1679e8ba0a15c211922ced9909c89e

    • Size

      563KB

    • MD5

      2b1679e8ba0a15c211922ced9909c89e

    • SHA1

      e1ea8f4ecd4b01f87275d3bd13c101facfbe9408

    • SHA256

      70351038cf49fc5bf127e4f7df1c563ec036293cbc00010ade2364e0ee311a27

    • SHA512

      924c86ab4eacb6db3a3327ba493e1fecd21c513335decd114b6e028ae2f29ad2be5549d6857afbd56203ffd05b0582682f41aeb6f3ed2a5254badbac663d5da9

    • SSDEEP

      12288:3FtowDCyEzuRczAeqUA+NWySj8uWXzx7yVfP4dcV7XiQVyQ7mo5oFCEkv:3Fto4CyEPsUnNW8Jm5PqcVj7mo5oFCEa

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks