Overview

overview

10

Static

static

3

BANK INFORMATION.exe

windows7-x64

10

BANK INFORMATION.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    69464677baefefa9421510d0017a5920_JaffaCakes118

  • Size

    576KB

  • Sample

    241022-g3hkpatdqp

  • MD5

    69464677baefefa9421510d0017a5920

  • SHA1

    5b3cb88de34595ee2ba8973683be28927e3dd701

  • SHA256

    316154ebe18ae1e80c63386a49a303e7dc3fdedb03d6940bc46cbc62e15a06cd

  • SHA512

    51908559eab09a9692c5534d32280ef2e1fa02e02b552302cbf9bc9dd906c9c66cb4f15d1aefe7a755a3992bffc812d244e54a87f58fc0c6dc84c68073a3b76c

  • SSDEEP

    12288:tHvaYHfHwmPVgqJjiG30YnxFTmKi0mMSurQyFlDh618B8Zz4ubp:tPdHBZJGGEYfm+mMSqQyFl4IGp

Score
10/10
snakekeyloggerdiscoverykeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      BANK INFORMATION.exe

    • Size

      678KB

    • MD5

      680b0b10a8435b833bcd423df49b97c9

    • SHA1

      2b7cee955568f6c999e7198a88b275145fff4a5f

    • SHA256

      6cbef3935de6e3aa2f3b42bfe47b0ced92955f6635b14c617025068ebb45473a

    • SHA512

      35565f047e85db6c19fdddc0ed0d8b89e91c06225383f1cf1c67a175ae30835abe61bf1e908144cedfd0cdda696077943ded477e7c428661551743789a8a8cfd

    • SSDEEP

      12288:bmWOE2iNeHK7zDVkQa6NZQbqIWZM66/H3KU4hVJC0j5MKcXmP/:iWz1bWJjbW+66/69hVRCVXmP/

    Score
    10/10
    snakekeyloggerdiscoverykeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks