Overview

overview

10

Static

static

3

P984758.exe

windows7-x64

10

P984758.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2a0a34ff96592d557f36ab0bc0ffdb75_JaffaCakes118

  • Size

    891KB

  • Sample

    241009-d3xstsvdqa

  • MD5

    2a0a34ff96592d557f36ab0bc0ffdb75

  • SHA1

    71b76437cee8d05605d7dedeb4c62cd29544b67f

  • SHA256

    6ef0104f7761092161e01e0f5d5b060287f69b0841a6445b7bcfab544a9674c8

  • SHA512

    5d3434bc7b949127e1cc3d8e306b2100dc340c1ab1d20dd4e729200a59bf739c6179c18aecdd11e347ca43cd16c6eaddc21b135e1ace205eb91feebd92f9a657

  • SSDEEP

    24576:vKSWKnBDLczy0Fg5/W1hUA1UXW/Uz07UhCNyqDuW:yCm/Uz1CuW

Score
10/10
snakekeyloggerdiscoverykeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      P984758.exe

    • Size

      846KB

    • MD5

      c5af54622602c908d5af6c3d8d7bdb09

    • SHA1

      67fbbcaef7c841afc2af6cda2740b3f934cd9c15

    • SHA256

      bbeac700ec88ce4b23f0bb5c996effc1586ef0e7802bc18695ecd3845a2a0022

    • SHA512

      b1194332113c466ddfb55bf4f6f0dd6a04bc3ceeac9654a913d0ac38689a93fa08888b950af0a701cfb7490ca1c322fbebe77f281be27c2a2a05e78dfa3d8961

    • SSDEEP

      24576:5vVPp9AR95STVO0NF64RWPOyvzQ6bnVOGeuo8:5vVPpKRSs0KBOybx

    Score
    10/10
    snakekeyloggerdiscoverykeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks