Overview

overview

10

Static

static

3

f92d58b970...18.exe

windows7-x64

10

f92d58b970...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f92d58b9705e8728143d035715bc89a3_JaffaCakes118

  • Size

    659KB

  • Sample

    240419-blgdeadd2t

  • MD5

    f92d58b9705e8728143d035715bc89a3

  • SHA1

    a407f2dfb4e67c3dc09b2b9331bae1bbb6b880cd

  • SHA256

    c82d157fcf1d827e3cf8f3ff8e377420739e01b092b8612aaa21616f0fa44026

  • SHA512

    55b6d6ee7c68550b7aeaa41a88f2ee14333bac91e4b274a05e08727f132741eb8837705a5510338c8db990fdeda888e04900401a49e9cb7f1a07fcc3579dab78

  • SSDEEP

    12288:A9wzdCR/5Q7b7lLhet87ESso8+V3O2To7k4:nzdCn2FUlSM+V+2To4

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    25
  • Username:
    admin@evapimlogs.com
  • Password:
    BkKMmzZ1
  • Email To:
    nonyekeylogger@gmail.com

Targets

    • Target

      f92d58b9705e8728143d035715bc89a3_JaffaCakes118

    • Size

      659KB

    • MD5

      f92d58b9705e8728143d035715bc89a3

    • SHA1

      a407f2dfb4e67c3dc09b2b9331bae1bbb6b880cd

    • SHA256

      c82d157fcf1d827e3cf8f3ff8e377420739e01b092b8612aaa21616f0fa44026

    • SHA512

      55b6d6ee7c68550b7aeaa41a88f2ee14333bac91e4b274a05e08727f132741eb8837705a5510338c8db990fdeda888e04900401a49e9cb7f1a07fcc3579dab78

    • SSDEEP

      12288:A9wzdCR/5Q7b7lLhet87ESso8+V3O2To7k4:nzdCn2FUlSM+V+2To4

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks