Overview

overview

10

Static

static

3

ZYJY-20210...41.exe

windows7-x64

10

ZYJY-20210...41.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    896ae494ece8972a877d841aeda9877c_JaffaCakes118

  • Size

    640KB

  • Sample

    241103-d1h7nawqek

  • MD5

    896ae494ece8972a877d841aeda9877c

  • SHA1

    1ded81eb000bf4bba8c602946c068fafb6565de9

  • SHA256

    a55fbfe62135a43ed75a86acc68d0b2bd0322f4fd26a308df1504070b61db472

  • SHA512

    42b68aab19da6ac8cbfaf5ff2bd243277db98e11f98efa8eb34b752201fdb3fe4c0258f08ffc591b3e9ec52bc059bbdaa575b98d378c3f4f3e0e3f363849b2da

  • SSDEEP

    12288:dl6+y0vBiuKQm02miaVE8IgPnnkkxjXYUGUY05oO8E0bgz2Y8:d0/0vBivQ+migEUPnkkxjXoUY05ME9zQ

Score
10/10
snakekeyloggerdiscoverykeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      ZYJY-2021010007.DBLF0445+446+441.exe

    • Size

      859KB

    • MD5

      d1994701f17adae13d520dcac95143a6

    • SHA1

      a300a063c0ff2d7d8fdfc5a02205a61836adfde6

    • SHA256

      4c0539b1d0a6fca3b802d94559079616acdb501b9544f4651cdf114cf7a6d700

    • SHA512

      d095968ed0605e6fe64bed986501ab4ac693d0ee3c199c5d870746fa059ef412833a74aa5b8b7bdb03f596ce58eacdd9047a42c04cb38458d7232c15d2be45ea

    • SSDEEP

      24576:Giz7knty6Ea5oBlQ9AHk5x4+QA4k3Kbog:Giz7kty6EuozQ9AEgj7k60g

    Score
    10/10
    snakekeyloggerdiscoverykeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Snakekeylogger family

      snakekeylogger

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks