snakekeylogger | 57c6ce03a179c46ceb169eae0d76ee19fe224b36db65139cf5eefa94c35e5ba3 | Triage

Submit
Reports

Overview

overview

Static

static

3

543a9db368...18.exe

windows7-x64

543a9db368...18.exe

windows10-2004-x64

7

$PLUGINSDI...nn.dll

windows7-x64

3

$PLUGINSDI...nn.dll

windows10-2004-x64

3

Sharing

General

Target

543a9db368c33915bcf44b7aa00013cf_JaffaCakes118
Size

711KB
Sample

240331-mjy18aac51
MD5

543a9db368c33915bcf44b7aa00013cf
SHA1

99ef6b338b105e698f8cf0ef12a2d37f331e39d0
SHA256

57c6ce03a179c46ceb169eae0d76ee19fe224b36db65139cf5eefa94c35e5ba3
SHA512

0663b0054b284049efacdad8650c9d1be94e583e9493bcc73a09897457396249fcfc50a7a73adb1349eeeea550ca97513b51bc98eb9f18e3be1fde4c1ac71d82
SSDEEP

12288:jJ1FGs+9KgR7BnkPnoGAi8mOZY/a+bm8qrIYKQeuls9:lH+9DR7BkvoPnMa+baUYKQeKU

Score

10^/10

snakekeylogger keylogger stealer

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe

Resource

win7-20240221-en

snakekeylogger keylogger stealer

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe

Resource

win10v2004-20240226-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral3

Sample

$PLUGINSDIR/ukczapxqnn.dll

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/ukczapxqnn.dll

Resource

win10v2004-20231215-en

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Targets

- Target
  
  543a9db368c33915bcf44b7aa00013cf_JaffaCakes118
- Size
  
  711KB
- MD5
  
  543a9db368c33915bcf44b7aa00013cf
- SHA1
  
  99ef6b338b105e698f8cf0ef12a2d37f331e39d0
- SHA256
  
  57c6ce03a179c46ceb169eae0d76ee19fe224b36db65139cf5eefa94c35e5ba3
- SHA512
  
  0663b0054b284049efacdad8650c9d1be94e583e9493bcc73a09897457396249fcfc50a7a73adb1349eeeea550ca97513b51bc98eb9f18e3be1fde4c1ac71d82
- SSDEEP
  
  12288:jJ1FGs+9KgR7BnkPnoGAi8mOZY/a+bm8qrIYKQeuls9:lH+9DR7BkvoPnMa+baUYKQeKU
Score

10^/10

snakekeylogger keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/ukczapxqnn.dll
- Size
  
  106KB
- MD5
  
  5a0549e4b724e46317ac8d0ff1f0aefe
- SHA1
  
  0d05ea79d334c8c44c8375367442325072532473
- SHA256
  
  0def082d0bbe804cfa3f70e3bc79cf1d97507506481f41f0f1761fb9a90e7ac1
- SHA512
  
  10ab45a6c0e71e3544176c2165fa4189825720434ee21924ea86d077eb929e07e38ddb2506e2d4006a4c1c88cf21dca31b80f8a1ca6793a748a7b420f7784e50
- SSDEEP
  
  1536:h0FgGACxpzur6su09gEmzVl4sNUEhzAIeCzvFa/HpRYB/I3Wklf9ncobUfsHEZ5F:2FgGAAuRQj4PERgpxlfrrO3A
Score

3^/10
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

snakekeyloggerkeyloggerstealer

behavioral2

behavioral3

behavioral4

© 2018-2024

Terms | Privacy