Overview

overview

10

Static

static

3

26108db5b6...18.exe

windows7-x64

10

26108db5b6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    26108db5b69562376697d90215395c87_JaffaCakes118

  • Size

    2.2MB

  • Sample

    240329-tarzwacd83

  • MD5

    26108db5b69562376697d90215395c87

  • SHA1

    ebd57ecda0c2a6cca843ead90d9c845376dfe47a

  • SHA256

    406776bc31b30cd94d3e6e50ea5adfac4817b2787c49f02e9ac096ea128f4843

  • SHA512

    d29a60d5dbe056f65a0655752e0a95a19718d021db8ad2d117e543bafeb46730f238facb3e3b1b7175a6de7e0915150b32686a4310d3b7dadf291ed1f52a249e

  • SSDEEP

    12288:mcf8x8hkm0WhdWCOt58IWDNuuc2eXNPnrEdrE:duj8IWDNuucxXN/odo

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      26108db5b69562376697d90215395c87_JaffaCakes118

    • Size

      2.2MB

    • MD5

      26108db5b69562376697d90215395c87

    • SHA1

      ebd57ecda0c2a6cca843ead90d9c845376dfe47a

    • SHA256

      406776bc31b30cd94d3e6e50ea5adfac4817b2787c49f02e9ac096ea128f4843

    • SHA512

      d29a60d5dbe056f65a0655752e0a95a19718d021db8ad2d117e543bafeb46730f238facb3e3b1b7175a6de7e0915150b32686a4310d3b7dadf291ed1f52a249e

    • SSDEEP

      12288:mcf8x8hkm0WhdWCOt58IWDNuuc2eXNPnrEdrE:duj8IWDNuucxXN/odo

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks