Overview

overview

10

Static

static

5

6fabfce57e...a1.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    241003-b1cc1a1fqg_pw_infected.zip

  • Size

    673KB

  • Sample

    241003-cmermsshma

  • MD5

    75939ebdbd9c763098d14e36ae287c5e

  • SHA1

    e6a78809abbaa6462d97ae387c71007a1e61feba

  • SHA256

    f32dfeaabd2147862768c8350e18ee49c60f62c9016f3ee2f466f6c58958a92b

  • SHA512

    699617616f3687d1d97f67bf3d52670e4f433a52c6543ed294aea291702696fb3f322ad5958be75eeaea10b2a422ba57a1930a2e78fc0afd59098ad66eda98b2

  • SSDEEP

    12288:aZUFxc499SArBrWPGLbMkA5kxzXhu5sdUlfrWPoxH628OGhw5V9jk0HP5a7y7bpA:aZqW4/SUBCGLbMkACOwoU26wRvhp8wno

Score
10/10
snakekeyloggercollectiondiscoverykeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot7680649284:AAG1mT6S_D1I5s0plOtxHel1WSk4LngQbVQ/sendMessage?chat_id=6980187819

Targets

    • Target

      6fabfce57e7c8674b37429eb9afec068608eec31f20c2b085a4b63c7f77873a1.exe

    • Size

      963KB

    • MD5

      5341cd0c95c935a73c2d3a3fb31db093

    • SHA1

      d2601f228938666674d5e6242d2b96c14ea98e51

    • SHA256

      6fabfce57e7c8674b37429eb9afec068608eec31f20c2b085a4b63c7f77873a1

    • SHA512

      37a627d82b0a7cb904ad2db75f4ce3ca3e71cfced8a8902569d32c963e042c34945df27cf27052e87cb452719c58220c71830398c12e7b72184d76adcc677f8d

    • SSDEEP

      24576:uRmJkcoQricOIQxiZY1iaChCsijnnapIz7E:7JZoQrbTFZY1iaCQJapI8

    Score
    10/10
    snakekeyloggercollectiondiscoverykeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks