Overview

overview

10

Static

static

3

efe46e1ba7...18.exe

windows7-x64

10

efe46e1ba7...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118

  • Size

    301KB

  • Sample

    240415-ax29kshg74

  • MD5

    efe46e1ba7f2f375e0fa71598b1cce4b

  • SHA1

    eba5c96d60f8bf245568ebc743ac4e10f6839576

  • SHA256

    d43d9ff45f1d4ed26b5722c3c61c9d09d39ba76e9ce1c322867d65d05b86f3db

  • SHA512

    b625b897f2803313ac30a1d996dd9bb72d6ce3be876085099178a7ebe9f398158d7727a1ca01338b68dcc856e3b87d0b37260d70f31707c9a5e4d5af4101afed

  • SSDEEP

    6144:+yaUM/MkhBC0NcyCD9K3fE0mNaGoJRBUJ6PQUXR5drIllAazio:+7aSBTa/D9asTxoJRBUJ6PBlrIlyazi

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    smtp.vivaldi.net
  • Port:
    587
  • Username:
    williamsr3@vivaldi.net
  • Password:
    1Endurance1234
  • Email To:
    williamsr3@vivaldi.net

Targets

    • Target

      efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118

    • Size

      301KB

    • MD5

      efe46e1ba7f2f375e0fa71598b1cce4b

    • SHA1

      eba5c96d60f8bf245568ebc743ac4e10f6839576

    • SHA256

      d43d9ff45f1d4ed26b5722c3c61c9d09d39ba76e9ce1c322867d65d05b86f3db

    • SHA512

      b625b897f2803313ac30a1d996dd9bb72d6ce3be876085099178a7ebe9f398158d7727a1ca01338b68dcc856e3b87d0b37260d70f31707c9a5e4d5af4101afed

    • SSDEEP

      6144:+yaUM/MkhBC0NcyCD9K3fE0mNaGoJRBUJ6PQUXR5drIllAazio:+7aSBTa/D9asTxoJRBUJ6PBlrIlyazi

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks