Overview

overview

10

Static

static

3

41a9659c1a...cc.exe

windows7-x64

10

41a9659c1a...cc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    957630fbcbcb6df95b514de4f946351b439a373c525860edd25f7ca19c35703c

  • Size

    645KB

  • Sample

    240417-rza2jsdg8x

  • MD5

    d2c605a725cd03daf76372b19311a4d2

  • SHA1

    183a299631201e1a001c58d4421887603989f26e

  • SHA256

    957630fbcbcb6df95b514de4f946351b439a373c525860edd25f7ca19c35703c

  • SHA512

    36d09fdfd75a7a05c8cc5327aa937db558b821bade4661150fb347337d0e19755b264a439047f4c805e62d28309b0b01eb98855fbe3f3a060343b66138286fcc

  • SSDEEP

    12288:cFG1eRB4Ej1Kw4GLgUiTGY6d6SKss4zeAGSqX+/vsjRG4056HDi:5EUYiud6WVzeAsX+/vAAOHG

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

C2

http://varders.kozow.com:8081

http://aborters.duckdns.org:8081

http://anotherarmy.dns.army:8081

Targets

    • Target

      41a9659c1afd7401afa60b5f613a2dc2df8a60d81efa13012bff19e17d1764cc.exe

    • Size

      673KB

    • MD5

      afedbc4accabba77d0c9dbf19797050f

    • SHA1

      7333e8497c58ba78a651586d8059ade8dbc1b00d

    • SHA256

      41a9659c1afd7401afa60b5f613a2dc2df8a60d81efa13012bff19e17d1764cc

    • SHA512

      ce792a725c6c0b2f1ab7cb72d7508ecb9f6f3d50d8aa54e87f6dd2d89c4206fe5db5b5b3823dd95516b68d0ae22d2ed26423099991ea1b118b39a8c8bca6c515

    • SSDEEP

      12288:/BsxaYpdJSF0dHr/RY5dA6n/GhCEXXy6q3QlT7P3b3itCg83pZv11hU4EaEfo68/:OJA0V5Y5dV/Gh5vq3Q1by0f3p84Mfo6w

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks