Overview

overview

10

Static

static

3

4b5a09ba95...08.exe

windows7-x64

10

4b5a09ba95...08.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b5a09ba9550d5f1c81460d748c09808

  • Size

    867KB

  • Sample

    240108-ny81eahbar

  • MD5

    4b5a09ba9550d5f1c81460d748c09808

  • SHA1

    d4e26318505f24a211be5a1d7dd6b00d3d73b324

  • SHA256

    413656d4ad3a348eb1de3b109e65420449c45b34638475978782ab394e1ef6ce

  • SHA512

    0b631de41a767dea17e5890daa52c8605208c71a589c8651b4933e1dcab64370d1788216ac9bb481439c75b1909650dd189250fef84537db8e6d30606decb39d

  • SSDEEP

    12288:kZPDA3xSX+sEu3aqk+02J+r24ORQKraLzflgh+:m7WxoEu3aqk58+y4wQp2h+

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials
C2

https://api.telegram.org/bot1483662500:AAGrMuxJV05-It-ke-xXVV6-R6IAtETpJb0/sendMessage?chat_id=1300181783

Targets

    • Target

      4b5a09ba9550d5f1c81460d748c09808

    • Size

      867KB

    • MD5

      4b5a09ba9550d5f1c81460d748c09808

    • SHA1

      d4e26318505f24a211be5a1d7dd6b00d3d73b324

    • SHA256

      413656d4ad3a348eb1de3b109e65420449c45b34638475978782ab394e1ef6ce

    • SHA512

      0b631de41a767dea17e5890daa52c8605208c71a589c8651b4933e1dcab64370d1788216ac9bb481439c75b1909650dd189250fef84537db8e6d30606decb39d

    • SSDEEP

      12288:kZPDA3xSX+sEu3aqk+02J+r24ORQKraLzflgh+:m7WxoEu3aqk58+y4wQp2h+

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks