Overview

overview

10

Static

static

3

f5f6f3f20d...18.exe

windows7-x64

10

f5f6f3f20d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118

  • Size

    994KB

  • Sample

    240417-rl11tabe38

  • MD5

    f5f6f3f20d2279fbcfe3459c2f506996

  • SHA1

    af053d5263eaf3260eabb37822361c1017a18306

  • SHA256

    0497fc206987e992f615638411ea9da0470e2dcbcd05546d4240ef09a82f925f

  • SHA512

    a88fae8375449bf448148098b95d98df598cc0985ee9c6bfb6ab585d1e85c7d91cffbd1c8c6504832da8b82042726d6c3a9d7a3a1bc09b96618bd0e810fdb23c

  • SSDEEP

    24576:STbtwEMGXU0oS1uhX+mOPEXPbc2b95QOz3:SHpMuTut7TXb95H3

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    log@procreditb.com
  • Password:
    Blessings16
  • Email To:
    log@procreditb.com

Targets

    • Target

      f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118

    • Size

      994KB

    • MD5

      f5f6f3f20d2279fbcfe3459c2f506996

    • SHA1

      af053d5263eaf3260eabb37822361c1017a18306

    • SHA256

      0497fc206987e992f615638411ea9da0470e2dcbcd05546d4240ef09a82f925f

    • SHA512

      a88fae8375449bf448148098b95d98df598cc0985ee9c6bfb6ab585d1e85c7d91cffbd1c8c6504832da8b82042726d6c3a9d7a3a1bc09b96618bd0e810fdb23c

    • SSDEEP

      24576:STbtwEMGXU0oS1uhX+mOPEXPbc2b95QOz3:SHpMuTut7TXb95H3

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks