Overview

overview

10

Static

static

3

3ae42a5753...24.exe

windows7-x64

10

3ae42a5753...24.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e4148002f40928b4e50e37c704b8cd8be896c08a5a5e7a933306a3cf72e133ae

  • Size

    339KB

  • Sample

    240914-trvr4asgml

  • MD5

    d054c610855778ace5988c1ed2f56358

  • SHA1

    aecaa4fbb4dd48d568aef05fa0505720b2e351f8

  • SHA256

    e4148002f40928b4e50e37c704b8cd8be896c08a5a5e7a933306a3cf72e133ae

  • SHA512

    c62244f3bd721b7830f9206687ca3fe15ad683dcf4a59ef40ff34da3b45a62286aae0a2b87cc1f5499a3526911a96df714ca5b9a196f8521a6dec77a3bfdc117

  • SSDEEP

    6144:zo7Z013JhwwRufbsG+6Qg8WfplRs6SXi4B9vMvzs6lE/rElf1o3:8UbR+I28Wf3RsVS4TMrM/r0t0

Score
10/10
snakekeyloggerdiscoverykeyloggerpersistencestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    smtp.zoho.eu
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    office12#

Targets

    • Target

      3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe

    • Size

      596KB

    • MD5

      bf3859ec3e62336825a3a771cab003d7

    • SHA1

      b1b10e05ee0ad49b262e187a1e72d806c2b801df

    • SHA256

      3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24

    • SHA512

      e23aa6f95903b1b9bca1149b5cd2f9a53050c58639df03eaddaae87b134cad3601f9aaae7946e943730f3022c3fa6649dce5735f3148a205d529ae18337fce52

    • SSDEEP

      12288:9r+oHDm3BygOebEJvhqHr6qJZrm7JHp+NMRN+p/wRyTooYkxiNtu:d+wDe9OeOvaeb7iytu

    Score
    10/10
    snakekeyloggerdiscoverykeyloggerpersistencestealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks