snakekeylogger | 300255f5b9216ec3e80aeb8d74b644f7b8ec836c56eee077c793ae348514dcc4 | Triage

Submit
Reports

Overview

overview

Static

static

3

4220b349c4...18.exe

windows7-x64

4220b349c4...18.exe

windows10-2004-x64

Sharing

General

Target

4220b349c4c00a018bb7452434468205_JaffaCakes118
Size

745KB
Sample

241013-z6nj8aygqd
MD5

4220b349c4c00a018bb7452434468205
SHA1

27f06ebaded2463ca1be630869b3ee07ab5f7ff2
SHA256

300255f5b9216ec3e80aeb8d74b644f7b8ec836c56eee077c793ae348514dcc4
SHA512

5dc61b0aefb7c3a43b699aac0040662bd7dd8f48fe7999eb08b6645a86782edf41ddf5be2daa72ec0962cb4e0a35527e907c7b00a5b0a6e3d97c4e1145f1738c
SSDEEP

12288:gD/HK7zJaXDYCY6Up2uKdyUwlCsq3cpMJHay6OfA5Vhm3sZ3ooFYEwf6R+D7Zz+q:gelaXUXp2XyUxs+laH

Score

10^/10

snakekeylogger discovery keylogger stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

4220b349c4c00a018bb7452434468205_JaffaCakes118.exe

Resource

win7-20240903-en

snakekeylogger discovery keylogger stealer

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

4220b349c4c00a018bb7452434468205_JaffaCakes118.exe

Resource

win10v2004-20241007-en

snakekeylogger discovery keylogger stealer

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  4220b349c4c00a018bb7452434468205_JaffaCakes118
- Size
  
  745KB
- MD5
  
  4220b349c4c00a018bb7452434468205
- SHA1
  
  27f06ebaded2463ca1be630869b3ee07ab5f7ff2
- SHA256
  
  300255f5b9216ec3e80aeb8d74b644f7b8ec836c56eee077c793ae348514dcc4
- SHA512
  
  5dc61b0aefb7c3a43b699aac0040662bd7dd8f48fe7999eb08b6645a86782edf41ddf5be2daa72ec0962cb4e0a35527e907c7b00a5b0a6e3d97c4e1145f1738c
- SSDEEP
  
  12288:gD/HK7zJaXDYCY6Up2uKdyUwlCsq3cpMJHay6OfA5Vhm3sZ3ooFYEwf6R+D7Zz+q:gelaXUXp2XyUxs+laH
Score

10^/10

snakekeylogger discovery keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

snakekeyloggerdiscoverykeyloggerstealer

behavioral2

snakekeyloggerdiscoverykeyloggerstealer

© 2018-2024

Terms | Privacy