snakekeylogger | 16359c43466ea68f824825178d9dfd58784c95a2f88157ed52f1f0a3d321e15d | Triage

Submit
Reports

Overview

overview

Static

static

3

16359c4346...5d.exe

windows7-x64

16359c4346...5d.exe

windows10-2004-x64

Sharing

General

Target

16359c43466ea68f824825178d9dfd58784c95a2f88157ed52f1f0a3d321e15d
Size

642KB
Sample

241026-xjvc5sycnr
MD5

b07572205f266f5cea703bc6ccf74f39
SHA1

a0d45cfc2f4ecc337ce7aa48c48c8a341819e6e8
SHA256

16359c43466ea68f824825178d9dfd58784c95a2f88157ed52f1f0a3d321e15d
SHA512

eeafe01426bcbb807d6fed665cd97f1c174fd46253e2600aeeb20dbc551bd128b5c075bdd4efb1c44c73d38dc877b05caeca39d59976eb69c542c71df741f4ba
SSDEEP

12288:QoNoqGHHqkMd05IninF+YhN3to0+YDB+gstfk3bUhc:QoNKHK+I2kYhN3twPObc

Score

10^/10

snakekeylogger discovery execution keylogger stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

16359c43466ea68f824825178d9dfd58784c95a2f88157ed52f1f0a3d321e15d.exe

Resource

win7-20240903-en

snakekeylogger discovery execution keylogger stealer

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

16359c43466ea68f824825178d9dfd58784c95a2f88157ed52f1f0a3d321e15d.exe

Resource

win10v2004-20241007-en

snakekeylogger discovery execution keylogger stealer

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  16359c43466ea68f824825178d9dfd58784c95a2f88157ed52f1f0a3d321e15d
- Size
  
  642KB
- MD5
  
  b07572205f266f5cea703bc6ccf74f39
- SHA1
  
  a0d45cfc2f4ecc337ce7aa48c48c8a341819e6e8
- SHA256
  
  16359c43466ea68f824825178d9dfd58784c95a2f88157ed52f1f0a3d321e15d
- SHA512
  
  eeafe01426bcbb807d6fed665cd97f1c174fd46253e2600aeeb20dbc551bd128b5c075bdd4efb1c44c73d38dc877b05caeca39d59976eb69c542c71df741f4ba
- SSDEEP
  
  12288:QoNoqGHHqkMd05IninF+YhN3to0+YDB+gstfk3bUhc:QoNKHK+I2kYhN3twPObc
Score

10^/10

snakekeylogger discovery execution keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Snakekeylogger family
  snakekeylogger
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

snakekeyloggerdiscoveryexecutionkeyloggerstealer

behavioral2

snakekeyloggerdiscoveryexecutionkeyloggerstealer

© 2018-2024

Terms | Privacy