Overview

overview

10

Static

static

3

91b20cd419...4b.exe

windows7-x64

10

91b20cd419...4b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    91b20cd419833222c4bfdf40ac9126f0519e799f0a237192433b9a6cf3ab1a4b

  • Size

    654KB

  • Sample

    241022-16fp2syhjk

  • MD5

    ace7321f101fddbc56f6b8a1754c6480

  • SHA1

    d9d534d2ae693ef58f45cd1c8925639408839fbe

  • SHA256

    91b20cd419833222c4bfdf40ac9126f0519e799f0a237192433b9a6cf3ab1a4b

  • SHA512

    55fe40c3fb6e884086267370c928af043a4bcdbe6c75e9c879351458e8940299ff1abf0fe54421a3c2c44a0bb30a54979990fdd284a00b1ace501011a6a59dd2

  • SSDEEP

    12288:DW0TFYJW0Qya7OsO1Bq2G4qNQScuH8Vv8NhSAQkSHAC8GxLuyNJwF1:D7YJW0Qya7DO/qLNQ7r8NYAQNACRw

Score
10/10
snakekeyloggerdiscoveryexecutionkeyloggerstealer

Malware Config

Targets

    • Target

      91b20cd419833222c4bfdf40ac9126f0519e799f0a237192433b9a6cf3ab1a4b

    • Size

      654KB

    • MD5

      ace7321f101fddbc56f6b8a1754c6480

    • SHA1

      d9d534d2ae693ef58f45cd1c8925639408839fbe

    • SHA256

      91b20cd419833222c4bfdf40ac9126f0519e799f0a237192433b9a6cf3ab1a4b

    • SHA512

      55fe40c3fb6e884086267370c928af043a4bcdbe6c75e9c879351458e8940299ff1abf0fe54421a3c2c44a0bb30a54979990fdd284a00b1ace501011a6a59dd2

    • SSDEEP

      12288:DW0TFYJW0Qya7OsO1Bq2G4qNQScuH8Vv8NhSAQkSHAC8GxLuyNJwF1:D7YJW0Qya7DO/qLNQ7r8NYAQNACRw

    Score
    10/10
    snakekeyloggerdiscoveryexecutionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks