Overview

overview

10

Static

static

5

Shipping D...df.exe

windows7-x64

3

Shipping D...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7c6e89a13ebaa14e419bd5d6c206dde17db5fa0d3b5d42d0a06dbd42c026b3b6N

  • Size

    1.1MB

  • Sample

    241013-vlt42sxemc

  • MD5

    fb6668313c23b556fcc37ea86abf7690

  • SHA1

    cf2420d2883b030c65ea9c50da04f91dc8a3cef7

  • SHA256

    7c6e89a13ebaa14e419bd5d6c206dde17db5fa0d3b5d42d0a06dbd42c026b3b6

  • SHA512

    23a2a05fec866cd4eaf529edede3ad33d1240afdf87b50f63564583fd244e474efd17898f09c39b905b1ab14ac717c03b2a97112efa365adc97d81c1dd7e67a0

  • SSDEEP

    24576:2DiLuiTW1fd9/dXMPI3wNf7la+AyPodDHro4rf:zBedMPk9dDh

Score
10/10
snakekeyloggerdiscoverykeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      Shipping Documents_Pdf.exe

    • Size

      1.3MB

    • MD5

      dea5082a3541fe4de74d82fa1aa68485

    • SHA1

      af13f6421876b3fcd15bfa579bf2d4f461e315f3

    • SHA256

      9af3fd91cfda8538cecd24a9221ee88cb8fec6f44b5d407703ff913cd1302d1c

    • SHA512

      f962782dccab7f70980f1dd92e02b28d3724054692c0537b5944360be34c1251a99538cdd7461e303920d2c05c8c0eab9b5c9f8b1839686b8815a7f39e462c0c

    • SSDEEP

      24576:uqDEvCTbMWu7rQYlBQcBiT6rprG8aY1VhJG7qWA3K2lQev8KlsM:uTvC/MTQYxsWR7aqVW7qW4lnrl

    Score
    10/10
    discoverysnakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks