Overview

overview

10

Static

static

3

po110-11�...G .exe

windows10-1703-x64

10

po110-11�...G .exe

windows10-2004-x64

10

Resubmissions

01-10-2024 05:06

241001-frh7eawdjf 10

01-10-2024 05:02

241001-fpar9awckh 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    po110-11　Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .rar

  • Size

    513KB

  • Sample

    241001-frh7eawdjf

  • MD5

    1b1af04ec4f1ac9e53318d824992b984

  • SHA1

    2db68b832870387e5060705558c874f6fb0cb956

  • SHA256

    ce10a536feb43d93646ca39eda3dd4f240c1d0617cdf96824fed80add67b4fdf

  • SHA512

    ee99383a51be68d8e361a548191529e67f0a66e285349ecce625641bf63f9166bc15341d657faf88ee1240229f8901464778392b63c9574adccc70eaca8decd1

  • SSDEEP

    12288:BuH3YfZ9glbObjgURKCnp3TDaqOM16iSZQX7i2X5:BusgYbsUDp3316ifX7lX5

Score
10/10
snakekeyloggerdiscoveryexecutionkeyloggerstealer

Malware Config

Targets

    • Target

      po110-11　Order_ROYPOWTECH %100% S51105P-E01 （最新）IMG .exe

    • Size

      618KB

    • MD5

      43523528dffe8705862304986c04665d

    • SHA1

      d94e95afbbd1ae578ceff278ade301ebd7dfbdf6

    • SHA256

      822e06191849b35415693155a46edff39c41db14f3dce949120456c1b7b55892

    • SHA512

      b6ad05059763d326c4e0e799ff1324ac141c1a5f4e443b2ca07de643dc80daec5860cb40f1c400b3e9ada6bd319aebc805b4dbda1924aad31b0014e2440e79d8

    • SSDEEP

      12288:Wa27wCe1S4QKMVkdg0uUG3DgIdGztFeQDHVxE:p2MCeL7eKG8IdOF/7E

    Score
    10/10
    snakekeyloggerdiscoveryexecutionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks