snakekeylogger | f9c99819e882b21b76cf3397677ec58d55243ef1852c3105a3e324c4cf60dafd | Triage

Submit
Reports

Overview

overview

Static

static

3

840b567a9e...18.exe

windows7-x64

840b567a9e...18.exe

windows10-2004-x64

Sharing

General

Target

840b567a9e2a4b9d9cc93ebb3d2e551e_JaffaCakes118
Size

728KB
Sample

241101-eyjk3swhqb
MD5

840b567a9e2a4b9d9cc93ebb3d2e551e
SHA1

2beb298cbf5c2e85ef0afce25610ecb9a3e07513
SHA256

f9c99819e882b21b76cf3397677ec58d55243ef1852c3105a3e324c4cf60dafd
SHA512

9314e039acaf7003316411980c6bb1916e57e0a908fa8008590caf32d4e5f4328a540e49a77370e7b78d1c39a98d5190a748ed47866b354aee0f5e937051fbc5
SSDEEP

12288:AsUhjs1UvptQgVFyxzrt7uZVbqL6vFzDOFXiWxBkEryJF4W+vHVwamVDc4/9vopU:DkWmqgVF45ayinOFXpk/MReampc4/9v9

Score

10^/10

snakekeylogger discovery keylogger stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

840b567a9e2a4b9d9cc93ebb3d2e551e_JaffaCakes118.exe

Resource

win7-20241010-en

snakekeylogger discovery keylogger stealer

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

840b567a9e2a4b9d9cc93ebb3d2e551e_JaffaCakes118.exe

Resource

win10v2004-20241007-en

snakekeylogger discovery keylogger stealer

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  840b567a9e2a4b9d9cc93ebb3d2e551e_JaffaCakes118
- Size
  
  728KB
- MD5
  
  840b567a9e2a4b9d9cc93ebb3d2e551e
- SHA1
  
  2beb298cbf5c2e85ef0afce25610ecb9a3e07513
- SHA256
  
  f9c99819e882b21b76cf3397677ec58d55243ef1852c3105a3e324c4cf60dafd
- SHA512
  
  9314e039acaf7003316411980c6bb1916e57e0a908fa8008590caf32d4e5f4328a540e49a77370e7b78d1c39a98d5190a748ed47866b354aee0f5e937051fbc5
- SSDEEP
  
  12288:AsUhjs1UvptQgVFyxzrt7uZVbqL6vFzDOFXiWxBkEryJF4W+vHVwamVDc4/9vopU:DkWmqgVF45ayinOFXpk/MReampc4/9v9
Score

10^/10

snakekeylogger discovery keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Snakekeylogger family
  snakekeylogger
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

snakekeyloggerdiscoverykeyloggerstealer

behavioral2

snakekeyloggerdiscoverykeyloggerstealer

© 2018-2024

Terms | Privacy