Overview

overview

10

Static

static

3

88137ef5ca...65.exe

windows7-x64

10

88137ef5ca...65.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4bc758d8221e17d247ccbb043a73822e034cd67c16564154b1ccf41087d7b869

  • Size

    352KB

  • Sample

    240417-rcy5vsba24

  • MD5

    9ced838bc2b49986a97f5abe096a4802

  • SHA1

    5e9d57e1e5bcb36bcb6822a259be85421dba0795

  • SHA256

    4bc758d8221e17d247ccbb043a73822e034cd67c16564154b1ccf41087d7b869

  • SHA512

    54a72e271736adca386d289aacf1fbbe260d8a64a1fb2b02e22023f851d5e350cb8d158c45af42c5bd25d43893010bf6138f237b81736056f4c63dcea6fa29b0

  • SSDEEP

    6144:tVx2OvhF02SpHlDc9k2RIns3jf0ONNzDu0tFCN+YbZzeZQ39iKCoJlj:jxv05Jcsnojf5M6lYl6ZQ3PH/j

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://scratchdreams.tk

Targets

    • Target

      88137ef5ca05130558e846da3d480008f2e5488a7543872195f64daa5a04b365.exe

    • Size

      459KB

    • MD5

      8ad01c64b357780c078e44780c322600

    • SHA1

      a016f5f6ff8a89557e34b5e5173dfc8a9a50b6ab

    • SHA256

      88137ef5ca05130558e846da3d480008f2e5488a7543872195f64daa5a04b365

    • SHA512

      e1d0a7c2749b1f06fa22c8f0a3b134f8220b9c4898e8af9d7c1ee33567f07d245f606ddb74e02afa71c7f4076051afb1c99f72f5d47da2efa1ed5534a1de825d

    • SSDEEP

      6144:q+hiQ1o1emq43RaLJM5hp8Sp1YX7RdE66hYM30mztCiLAzvmBsOuRLX3+0Wtz6t0:74ZqGhF7uidhYM7COQvmBsOeetyAQF

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks