Overview

overview

10

Static

static

3

ede92f15ba...18.exe

windows7-x64

10

ede92f15ba...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ede92f15babb8282aaa74dc9eec1f410_JaffaCakes118

  • Size

    764KB

  • Sample

    240411-vf67esbb31

  • MD5

    ede92f15babb8282aaa74dc9eec1f410

  • SHA1

    07eead1dddb7fd3929c927bc57fb3859f62bd4ba

  • SHA256

    eee618150688bfe6957ce59522472fdee3ea9e539f7a09430e61a76e2074f897

  • SHA512

    c6521a314d2a2f7759c6c7e6718a915603f6955f05c9bc71ea116fc9fefa898b6621a496ae5987585b7d1516ae67af891d5f7040fefcc3197b7b946ed7fd919c

  • SSDEEP

    12288:e8XjDc9F3nC0Py3gAhgoqq5NF/NwIDySXbJ1g6kR2Ng8vGV8:Xfqq5N/P2wbJi6Vgam8

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      ede92f15babb8282aaa74dc9eec1f410_JaffaCakes118

    • Size

      764KB

    • MD5

      ede92f15babb8282aaa74dc9eec1f410

    • SHA1

      07eead1dddb7fd3929c927bc57fb3859f62bd4ba

    • SHA256

      eee618150688bfe6957ce59522472fdee3ea9e539f7a09430e61a76e2074f897

    • SHA512

      c6521a314d2a2f7759c6c7e6718a915603f6955f05c9bc71ea116fc9fefa898b6621a496ae5987585b7d1516ae67af891d5f7040fefcc3197b7b946ed7fd919c

    • SSDEEP

      12288:e8XjDc9F3nC0Py3gAhgoqq5NF/NwIDySXbJ1g6kR2Ng8vGV8:Xfqq5N/P2wbJi6Vgam8

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks