Overview

overview

10

Static

static

3

ee5e1eabbd...18.exe

windows7-x64

10

ee5e1eabbd...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ee5e1eabbdb31b6191c744b77a1de93d_JaffaCakes118

  • Size

    915KB

  • Sample

    240411-z8gvfsgg4s

  • MD5

    ee5e1eabbdb31b6191c744b77a1de93d

  • SHA1

    8bccbae02b39c99584168067d7d515264d1ab9a5

  • SHA256

    5f1b0d6fca306c6614607fb58b497f765a482b9500c1f82c1696504460b07cd8

  • SHA512

    571fd6656ce39c4d11e6915038330da31b1c9863326e81d6df03adc02f5085db7c2544fe5e0730b41a569bbf29ecb477ae60c694c15ef9374bc1f5831ebdb7be

  • SSDEEP

    12288:LPdsn7TdmXiJnd/fq2+FVuKM4f7yXLsCf:DKnfdRJ5q2KVmm+sc

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    mail.sayimkalip.com
  • Port:
    587
  • Username:
    basar@sayimkalip.com
  • Password:
    3edcvfr4**
  • Email To:
    saleseuropower@yandex.com
C2

https://api.telegram.org/bot1483662500:AAGrMuxJV05-It-ke-xXVV6-R6IAtETpJb0/sendMessage?chat_id=1300181783

Targets

    • Target

      ee5e1eabbdb31b6191c744b77a1de93d_JaffaCakes118

    • Size

      915KB

    • MD5

      ee5e1eabbdb31b6191c744b77a1de93d

    • SHA1

      8bccbae02b39c99584168067d7d515264d1ab9a5

    • SHA256

      5f1b0d6fca306c6614607fb58b497f765a482b9500c1f82c1696504460b07cd8

    • SHA512

      571fd6656ce39c4d11e6915038330da31b1c9863326e81d6df03adc02f5085db7c2544fe5e0730b41a569bbf29ecb477ae60c694c15ef9374bc1f5831ebdb7be

    • SSDEEP

      12288:LPdsn7TdmXiJnd/fq2+FVuKM4f7yXLsCf:DKnfdRJ5q2KVmm+sc

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks