General

  • Target

    3cfe3c67fcddd89a702d21284ba3d165_JaffaCakes118

  • Size

    556KB

  • Sample

    240712-mfh6la1gkb

  • MD5

    3cfe3c67fcddd89a702d21284ba3d165

  • SHA1

    73693f562520d7d6dc239a82de4c01f06183c674

  • SHA256

    4921525fdbec4c32c91dcbda29c6abafa6abb1965c89907aa1c3ffc5dcc35c61

  • SHA512

    0cfebcabd55af45a6aec352793b0ef1843968d677287ccaff3a76faab6e1a904419ee277f8c4fdeb5fa21e26ac211d2f1760790ad6cec22395769d57971d60bb

  • SSDEEP

    12288:rSaGIQGWQqjV2ORiP2bstHTE0aeZmC1bDsT9dkFADKOG9elzdKWFYG+:rxQCqjtRiP2bsto0aSJspOFA1GgzsYR+

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot1599185091:AAFwjZ99E4P1IuAWSo1Ue568J97WLOPoV88/sendMessage?chat_id=652007142

Targets

    • Target

      NEW ORDER.19022021.exe

    • Size

      680KB

    • MD5

      b66330a8ce88bf8289252f2d1fba8c36

    • SHA1

      f6f6fbd9abb724a9b669415f03e0ee10516e736d

    • SHA256

      8cfafa2cbc8c24afe00f82ca7beef18000cd3ad1a2f45c97a0a6e1921df0c92f

    • SHA512

      565e47f13578cf3f96d65294e2613b9d0d888faf50bdb37ff89b44f24b3b4630c3325bc2e36a2eab2fcadf1301ae59b7112977fc9605e05deafac0ae7b7c09b5

    • SSDEEP

      12288:BEz6hGceTorDIW87RfD4dGGsX/evWmZi0elxw1I9xI/RYhl7wFzo/j:fBr0W8mdGoOmclN9+ml+o/

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks