Overview

overview

10

Static

static

3

7896ce09d6...18.exe

windows7-x64

10

7896ce09d6...18.exe

windows10-2004-x64

10

$PLUGINSDI...ux.dll

windows7-x64

10

$PLUGINSDI...ux.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7896ce09d6bf3dcb6d233fcee51d306f_JaffaCakes118

  • Size

    560KB

  • Sample

    240401-ycqxtade7t

  • MD5

    7896ce09d6bf3dcb6d233fcee51d306f

  • SHA1

    d75e191833bd36531468f4d7ba408a3c9504da3b

  • SHA256

    8fe74471f7e76b21be7e677b97a65d66cecaf52ff0c343ab0a93b303ee464c0e

  • SHA512

    0c0f8114b55f483496383637b5f168729e3b0cd6259110da7ecefdf9dbb899bab96950e46e959160eeb3c6139798655214f6826abc7d0fdb4fe9fb7f776251ac

  • SSDEEP

    12288:HZ8A8BB0blefqEbvfwCDka1SI+ddHLYCjuu/ekJevTLYTobT:58nYlefqEztDky+rHLiu/eH3bT

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Targets

    • Target

      7896ce09d6bf3dcb6d233fcee51d306f_JaffaCakes118

    • Size

      560KB

    • MD5

      7896ce09d6bf3dcb6d233fcee51d306f

    • SHA1

      d75e191833bd36531468f4d7ba408a3c9504da3b

    • SHA256

      8fe74471f7e76b21be7e677b97a65d66cecaf52ff0c343ab0a93b303ee464c0e

    • SHA512

      0c0f8114b55f483496383637b5f168729e3b0cd6259110da7ecefdf9dbb899bab96950e46e959160eeb3c6139798655214f6826abc7d0fdb4fe9fb7f776251ac

    • SSDEEP

      12288:HZ8A8BB0blefqEbvfwCDka1SI+ddHLYCjuu/ekJevTLYTobT:58nYlefqEztDky+rHLiu/eH3bT

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/yhrbectux.dll

    • Size

      30KB

    • MD5

      96112d00de78e6a6f7c9cd3b347ddd57

    • SHA1

      98a2f0bfd0f72c1039bac854f7b0b1b889e89104

    • SHA256

      73202aaad90d8e0f99ba6715b0fb8e35fd20368acf996e6c795301b4a421a1d2

    • SHA512

      af0aeb2ae5881764e320777dab092ef66fd6cfbcf0de269c2bc47c7a429517502398c9340eadc15501af5f270d5e56f4f6ae169bdcc8e87c08642241fb119825

    • SSDEEP

      768:May1uE0bONcu+4p7Hw/pXxH8KZm5f7pZwr:MaIh0bi5+g7HexHIZw

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Blocklisted process makes network request

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks