Overview

overview

10

Static

static

3

P.O 23876943.exe

windows7-x64

10

P.O 23876943.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2cc74ce1c185018c59c30dfdd2d65e9c_JaffaCakes118

  • Size

    550KB

  • Sample

    241009-hnx79svcpf

  • MD5

    2cc74ce1c185018c59c30dfdd2d65e9c

  • SHA1

    b1fd32954b93c89fc71ea67b8f9e8eff6dcb8aa5

  • SHA256

    ed28cb9ab1d7256d6ab5d8b43bf0c96e83a31e62693a2c4d149b68d4bbe93c0e

  • SHA512

    0f81400eff761cf2ed6ff91e96e454f67626c68faab3497cb12fa7067082c763bec653e9b054044e677274902bcef82e277e3455d483f9fec5cf95dae1869b27

  • SSDEEP

    12288:dFTqWq7d4PDPJulfHWatPHx/ErQyFTj3mMZ+WzZWQK:jq3ED0J2atPHhErrTyM8WzkQK

Score
10/10
snakekeyloggerdiscoverykeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      P.O 23876943.exe

    • Size

      666KB

    • MD5

      63cbf77b6342a627ca96c0e5021794a4

    • SHA1

      d7521e19982d54cf17ac513d606307a89a881b31

    • SHA256

      f82c03c2fb967d594b083b5c743270a4f4306ddf2f90e28b39e8e56911ad915e

    • SHA512

      2e95f7b697ef572269848607a01fa2def29d35b80bb5eac24db6f7bfaba756b6b0ef3e6c0658e78ac4ad0e68a795d6891fd04ae9c0a142047e1b5f47394d9860

    • SSDEEP

      12288:NnqdP4PBPtSJzH2afTHx/ErEgFTl3UMZuWzVWW:4EBQxWafTHhErPTKM4WzwW

    Score
    10/10
    snakekeyloggerdiscoverykeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks