Overview

overview

10

Static

static

3

1af4b1e67d...37.exe

windows7-x64

10

1af4b1e67d...37.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c26cd8dd1ff185994225fd907edc2aea01872f1b17e021c23afb76e553bb85a4

  • Size

    379KB

  • Sample

    240417-sa685aee9x

  • MD5

    02c65a28e1abde3affc3e4de4dd2c420

  • SHA1

    2b92893b081511e484cc4e1081194a2d092acd77

  • SHA256

    c26cd8dd1ff185994225fd907edc2aea01872f1b17e021c23afb76e553bb85a4

  • SHA512

    fe015ae32d3c3ac727c5b4c464eaa243e0a69624a85797ca711c116fc9ffa82ad11e7f0c95b31c3a766df0e46f72ba74a37933bc29105f1014878f07c016d6ab

  • SSDEEP

    6144:if5M9F1cIt+dq9zI8k/WZapMpC0r8qaGhCQ68wXonHDr5vJVd4qBzJ00Z0:if5c0ItHRI8kI0MpT7CQx/njrX3xzJ0X

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

C2

http://varders.kozow.com:8081

http://aborters.duckdns.org:8081

http://anotherarmy.dns.army:8081

Targets

    • Target

      1af4b1e67dee34e1ce541150c83e1be4f75766d47ecebf4b476cb08aa04fa837.exe

    • Size

      525KB

    • MD5

      3138b63ef0d439ebc2e631452307c089

    • SHA1

      176b629248c486842e03a897192dbc6043a57fe5

    • SHA256

      1af4b1e67dee34e1ce541150c83e1be4f75766d47ecebf4b476cb08aa04fa837

    • SHA512

      f83dcb33c5777d9efc9100705761786a7d1dada83331866a95fbd3042357f7d7b87aa36cc1dc7fcbe8e9af4118bdd1cd5e2734366c1cc7d1c85b95be8c6767c0

    • SSDEEP

      12288:/ytros3iYd2DGhjsTJWJHJ+HgyJsMgqFyaHs:/WosNDdRJHcHZJt

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks