Overview

overview

10

Static

static

3

BE-IZ-Q-12...AL.exe

windows7-x64

10

BE-IZ-Q-12...AL.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    878df7fd8ec553ff54eb7fae9d8cdba8_JaffaCakes118

  • Size

    1.9MB

  • Sample

    241102-y8gn1svbqf

  • MD5

    878df7fd8ec553ff54eb7fae9d8cdba8

  • SHA1

    34dafcba5eb9995522969dbeefbfbd94328de240

  • SHA256

    01d37601fd50c088f9be3cc2395e9f9ef3ffe3aee282147d0ebdd3bce0866cae

  • SHA512

    f4ac9a750d8db07bdd7be4cd27e9c279b36c8d205680b78848f95bfa6a1511b4505fa9ebb6744316457a6bde424cc6f2e5fdc90f4ff5cd8e9b06f6bb83ed3ad7

  • SSDEEP

    12288:+C3hpINYoA3P1/GyjcOgHf4uvP9H539XKfalV7T2fXOk/HmUVppUuEVCHo:+CTIN7EZVjcZHf4YbN6UV7T2fXOvOQ

Score
10/10
snakekeyloggerdiscoverykeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      BE-IZ-Q-1278-21 - COMMERCIAL.exe

    • Size

      1.3MB

    • MD5

      9c032d7fbfdfe2064f850a9f2f0cfcaa

    • SHA1

      81633e6bb46148fff7f81330c5ca43b055f17be0

    • SHA256

      522ef9da580292e5ef0de44c4c3522f8f4fea1f4248467ff66a7d638be7a305c

    • SHA512

      50df0bb3764e014c1cdb888c5984a2c0b8439be232e90eacceeb9a517354456858a4327b0194da72facddafb4a4ace377340e54eb0919d3c2a8bf46d3d15cda7

    • SSDEEP

      12288:MC3hpINYoA3P1/GyjcOgHf4uvP9H539XKfalV7T2fXOk/HmUVppUuEVCHo:MCTIN7EZVjcZHf4YbN6UV7T2fXOvOQ

    Score
    10/10
    snakekeyloggerdiscoverykeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Snakekeylogger family

      snakekeylogger

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks