Overview

overview

10

Static

static

3

QuotationR...65.exe

windows7-x64

10

QuotationR...65.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QuotationReferenceNoDX2265.exe

  • Size

    503KB

  • Sample

    241021-yhh46avcjr

  • MD5

    fa80fb2fedf1df252aa7c10c6cf22ff5

  • SHA1

    65dbe24bb00dc5278926b1849a1e853d72d6d372

  • SHA256

    8c9a2cdbc372e1eb39e247cc1d444c7b97c35061aaf9aa568c421fbc8c0d0cad

  • SHA512

    8fe343882e1627d7a9c36809ca051f27f2cd37769fcb0135c076f0173090acbac76cda912bc934d299c5465f7f274ca3e68296b1abadfa0b32141a2c9d25a909

  • SSDEEP

    12288:yg72ChrTx3+u+KaqNbXq1o8lIyBnxlQqVMORM:1ngjKaW6dISnxlQqVTR

Score
10/10
snakekeyloggercollectiondiscoverykeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials
C2

http://varders.kozow.com:8081

http://aborters.duckdns.org:8081

http://anotherarmy.dns.army:8081

Targets

    • Target

      QuotationReferenceNoDX2265.exe

    • Size

      503KB

    • MD5

      fa80fb2fedf1df252aa7c10c6cf22ff5

    • SHA1

      65dbe24bb00dc5278926b1849a1e853d72d6d372

    • SHA256

      8c9a2cdbc372e1eb39e247cc1d444c7b97c35061aaf9aa568c421fbc8c0d0cad

    • SHA512

      8fe343882e1627d7a9c36809ca051f27f2cd37769fcb0135c076f0173090acbac76cda912bc934d299c5465f7f274ca3e68296b1abadfa0b32141a2c9d25a909

    • SSDEEP

      12288:yg72ChrTx3+u+KaqNbXq1o8lIyBnxlQqVMORM:1ngjKaW6dISnxlQqVTR

    Score
    10/10
    snakekeyloggercollectiondiscoverykeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks