Overview

overview

10

Static

static

3

RFQ-110146.exe

windows7-x64

10

RFQ-110146.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a0867d9089bda8af44c72a9165ed99bd

  • Size

    579KB

  • Sample

    240223-2mm6fsaf84

  • MD5

    a0867d9089bda8af44c72a9165ed99bd

  • SHA1

    0f39a6ea3fafef298685abe8e229f1d2bbefdea2

  • SHA256

    1039602fc744770fbf900b6cb8f66ca8d751faf9e072130e5b4035caf046511a

  • SHA512

    bfb2e36fc1bbd987d3e078454fae5ffb8ce8269436640a910ad2b06dedbf607dd5cd0a64058b0c4d6f5f339956a152a02fc47276373898f13398c24fe33ddec4

  • SSDEEP

    12288:o54cGJMEUX8DTJWg6KU1dV339r5uOM5ic4lP7xhrQH93XNX10:o54/UcTJnlSnr3M5iceTxhEf+

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      RFQ-110146.exe

    • Size

      844KB

    • MD5

      42e9e8bca35f196255046a9640873a31

    • SHA1

      ac5449f53111107fc6d73e2fcf7125dfd1ea94fc

    • SHA256

      915e92b462c184dbe68f5c21fb0843e802969b7a3f20d30095e485e892c7a818

    • SHA512

      e290ce98b223ef791236538dec71a12e8448b5aeb54b4bcdbc16114fda279a7cdd422017846e2b934ab8ed80ec9e025ebe5b4c091c30a41e9441a7bcb22a5cb3

    • SSDEEP

      12288:Y6fftwLUW/hy7iS/d348nf9dgtOn16eqfg4OAlE+qmUu3AdqZBXRqvt0/BCh2Tne:3tup9S/d3r+8n1IjUu3A00vt0u2zK

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks