General

  • Target

    dec06cc9d18f85918d79945e80abe374

  • Size

    123KB

  • Sample

    240326-knfdkahd4x

  • MD5

    dec06cc9d18f85918d79945e80abe374

  • SHA1

    440e76a86775ad14f02bdbea79cef813c9ecd652

  • SHA256

    7eb4302c92c1de3d5b2cd6467abe82e996c14aa6795f928434206b9ee62cbad0

  • SHA512

    30dc1fb4ad6b34caed5f42d68c04beea7e72c290bf6359d4ecd98a94052eb36e68648c0e1accaaa7ed9101d1271ad5c61f1969fa4cc3637fbe9af9d27e2b9472

  • SSDEEP

    3072:yyX/GSiowfkrc52Xj9a4/9PbSr/wBM+O:p6fkI52T9blPbO+

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot1880141509:AAHjseWsCVnzygKB72YGbdj6S0DpdeKfGSs/sendMessage?chat_id=565072597

Targets

    • Target

      dec06cc9d18f85918d79945e80abe374

    • Size

      123KB

    • MD5

      dec06cc9d18f85918d79945e80abe374

    • SHA1

      440e76a86775ad14f02bdbea79cef813c9ecd652

    • SHA256

      7eb4302c92c1de3d5b2cd6467abe82e996c14aa6795f928434206b9ee62cbad0

    • SHA512

      30dc1fb4ad6b34caed5f42d68c04beea7e72c290bf6359d4ecd98a94052eb36e68648c0e1accaaa7ed9101d1271ad5c61f1969fa4cc3637fbe9af9d27e2b9472

    • SSDEEP

      3072:yyX/GSiowfkrc52Xj9a4/9PbSr/wBM+O:p6fkI52T9blPbO+

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix

Tasks