Overview

overview

10

Static

static

3

708ee4218d...d2.exe

windows7-x64

10

708ee4218d...d2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    abc34aec9a45b5f5da9b10738ea2f5efcd7a15c30c02ba68e5f19b101b552158

  • Size

    571KB

  • Sample

    240417-rrthxsbg88

  • MD5

    087087b333dd1626c8cbca671b85c17b

  • SHA1

    12f204f751335f893cf20a9df9fc806a36095eb3

  • SHA256

    abc34aec9a45b5f5da9b10738ea2f5efcd7a15c30c02ba68e5f19b101b552158

  • SHA512

    0ea87c55d2315b6b26ce2d352b1fc89130d7ac5b47c5f5600c35ec3217fd5b67b5e7ba1d35f444d5d7d46c98d912f154e4ff4f70f0f9056dce3c2058a34f1f25

  • SSDEEP

    12288:KKo3v3VRuCVTpr3VmwbUpCsJ/hihyhRgLP48FJ99gAb1OtuTeU:Knf3KYTpr3VmwY9hi8haTFJ9lstuv

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    mail.viajescoriatours.com
  • Port:
    587
  • Username:
    fmateos@viajescoriatours.com
  • Password:
    170717FteoS%
  • Email To:
    alfredbnolan@yandex.com
C2

http://varders.kozow.com:8081

http://aborters.duckdns.org:8081

http://anotherarmy.dns.army:8081

Targets

    • Target

      708ee4218d5907976919dff1722a69fe187648dcf3503a1544d822871a91fad2.exe

    • Size

      855KB

    • MD5

      69bbd35257d7603e97cddf814542ae3b

    • SHA1

      1b7fbdc11e81366d54b812bc9e165c9ed384f226

    • SHA256

      708ee4218d5907976919dff1722a69fe187648dcf3503a1544d822871a91fad2

    • SHA512

      8b8a62cf53d3cf3f89fbdca65f5e59f1844f2d96771172850634ef0c1cd53bafdb4c96fcd21d42f061e5686ffc3d5ebaec52a27a1f79abb350d727528efc601a

    • SSDEEP

      24576:ZTs8rLXJu1AFEwddHeWt+ZgUYeKaD8YynlF9D:ZTTLY1AFEwDHeAwtYeKa4YynlF9

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks