Overview

overview

10

Static

static

3

3e051c874a...18.exe

windows7-x64

10

3e051c874a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3e051c874adf5d4d29d50f16524c32a5_JaffaCakes118

  • Size

    577KB

  • Sample

    241013-f1jjjavfrr

  • MD5

    3e051c874adf5d4d29d50f16524c32a5

  • SHA1

    1770f5ce4f61419fc012656918637813345533d4

  • SHA256

    c4a153e412d20c6225b6c4778ddc8e149ee0b6fee402cf02a4c927ebb9d1488f

  • SHA512

    65644bc8134f1be9fc19825279eb2b00d9e692da56eec33256a15f66569b7dc032a116f194f0ebde33e8d2e8cddf99003b356c16b18bfb10b1d54e7cc371f13f

  • SSDEEP

    12288:MhCDCb8zsqTUV10HJG8U/ET8H/azC99Fn3KEEG675sWlL+iS:gFb0TSaEBb

Score
10/10
snakekeyloggerdiscoverykeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials
C2

https://api.telegram.org/bot1483662500:AAGrMuxJV05-It-ke-xXVV6-R6IAtETpJb0/sendMessage?chat_id=1300181783

Targets

    • Target

      3e051c874adf5d4d29d50f16524c32a5_JaffaCakes118

    • Size

      577KB

    • MD5

      3e051c874adf5d4d29d50f16524c32a5

    • SHA1

      1770f5ce4f61419fc012656918637813345533d4

    • SHA256

      c4a153e412d20c6225b6c4778ddc8e149ee0b6fee402cf02a4c927ebb9d1488f

    • SHA512

      65644bc8134f1be9fc19825279eb2b00d9e692da56eec33256a15f66569b7dc032a116f194f0ebde33e8d2e8cddf99003b356c16b18bfb10b1d54e7cc371f13f

    • SSDEEP

      12288:MhCDCb8zsqTUV10HJG8U/ET8H/azC99Fn3KEEG675sWlL+iS:gFb0TSaEBb

    Score
    10/10
    snakekeyloggerdiscoverykeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks