Overview

overview

10

Static

static

3

f7cc11cec3...18.exe

windows7-x64

10

f7cc11cec3...18.exe

windows10-2004-x64

7

$PLUGINSDI...zr.dll

windows7-x64

1

$PLUGINSDI...zr.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f7cc11cec3fab768dfc2939a7d84f5e9_JaffaCakes118

  • Size

    315KB

  • Sample

    240418-mekb9sbe8y

  • MD5

    f7cc11cec3fab768dfc2939a7d84f5e9

  • SHA1

    1991c3c97e615ddc3e1fdd45c6dece4c0052c943

  • SHA256

    d82eefa0193afb698d4121a88c3f938b3806a33ace81b5338f2c42ede1f830bb

  • SHA512

    b41868c447050e050f81b05cffcaf339cd1a570123d1513c8a6911daee253a6369d71f439df5f8725854d90fc8b1c7dbb25a864f594ac24b9826a535a563b300

  • SSDEEP

    6144:b8LxBqtPhY23qhQfbkQBLmAN1U4vUJBSrjqyVXYsDqcuUURBXc:nRhMhQfPw4fUJ0iyosGcuUUR9c

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot1816395306:AAE3ZBLYV2L9aT9mL8itL9vr3RP6nOz_B1o/sendMessage?chat_id=1368673464

Targets

    • Target

      f7cc11cec3fab768dfc2939a7d84f5e9_JaffaCakes118

    • Size

      315KB

    • MD5

      f7cc11cec3fab768dfc2939a7d84f5e9

    • SHA1

      1991c3c97e615ddc3e1fdd45c6dece4c0052c943

    • SHA256

      d82eefa0193afb698d4121a88c3f938b3806a33ace81b5338f2c42ede1f830bb

    • SHA512

      b41868c447050e050f81b05cffcaf339cd1a570123d1513c8a6911daee253a6369d71f439df5f8725854d90fc8b1c7dbb25a864f594ac24b9826a535a563b300

    • SSDEEP

      6144:b8LxBqtPhY23qhQfbkQBLmAN1U4vUJBSrjqyVXYsDqcuUURBXc:nRhMhQfPw4fUJ0iyosGcuUUR9c

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/nipybzr.dll

    • Size

      19KB

    • MD5

      fb81d6e8b03db5e77a3ef30496a34e45

    • SHA1

      e3d3ab6fd823720901a0c3a7507e34f863694045

    • SHA256

      17ea4d87ae8da53e61095790487d8f63d70bcc9dbde5e85c759f8e339e073540

    • SHA512

      236f579c51b531568579b817a00e631dd6d386cd89d02f583c23ff8874222c3983a477195b9de811c7f93289365704a0bfee342729dcb2f5673d4d7616cf737d

    • SSDEEP

      192:VH6t7BH8SCBZDX6r4mUOd6wjMBuGweaO87JAWEGSY/afkLtmhxMjyINmoz2Bj40h:VaH8Bkr4odPWAZJk1YafkVSzRlX

    Score
    1/10
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Tasks