Overview

overview

10

Static

static

3

5c1784fd01...70.exe

windows7-x64

10

5c1784fd01...70.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3fc5704b218d36edafda4e1235bd6e254b64e80938309cdbba9b5480da410911

  • Size

    444KB

  • Sample

    240417-sa1fksee8x

  • MD5

    7b92314744eb3ce684e2a8c15b347280

  • SHA1

    8d7bc192bee1e1237e5c538ecbbdcc1ad805f7a7

  • SHA256

    3fc5704b218d36edafda4e1235bd6e254b64e80938309cdbba9b5480da410911

  • SHA512

    60f373ad261427b4f1f68813ebdce3c32952cfef7e03ae7d45a69f6a1e17bef61e647156b65e77cb2086ccf92d0be97e762c78f1c7344ad452be66d6e2ba0cf1

  • SSDEEP

    12288:bJGX6B8ywIJczTCRt8nKyr1BAVs14YcsrqTr1pPDm:bMqK0CzTy8H1OVsuYVrw/PDm

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

C2

http://varders.kozow.com:8081

http://aborters.duckdns.org:8081

http://anotherarmy.dns.army:8081

Targets

    • Target

      5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe

    • Size

      772KB

    • MD5

      a8ef65a587aa367c3c5c9090dff4cc86

    • SHA1

      349ac86f57b328017c9c9b478a68f610778afbeb

    • SHA256

      5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370

    • SHA512

      356e6195db849e3cb4975579243c2f707349c6444350e09d384a3279874970bb42812d8533ed7e68d2332b22359e7dc8a9a22b2a43ba5e1ba10f69b95bedac71

    • SSDEEP

      12288:dJpHCmbiNIwP2sBpD1tM2MH6YZLuKw3WDJV733EgpAho8WAKo9mXe:ZCFP2WpD1tM2MTZLEew

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks