Extracted

• • Target
    2.exe
  • Size 682KB
  • SHA256 134be2720dc277e7be61620837bfd47e02892d9641294cbe4457d7bae4510a19
  • MD5 6e62c2f3acd34a6cf4eee9f493ceb3a1
  • SHA1 dc025bd9290f738c1870f7d9861da95af549dfd0
  • SHA512 20beb4e7572a1026603399676dc55573105f2359d418aa504f73a8486337b1843ab9ea8db6ccd3bd11b05ff2686b3cefdadbbef321d7da546da9a733b7c626e9
  • SSDEEP 12288:G0mnA1zxuAL9BFGFx6Dpu/ay+xSnliR6r9t3DSDb4NF:uA1zxumVoIDIikcu3ewb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionsnakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Blocklisted process makes network request

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    Chromonemal.Opg
  • Size 53KB
  • SHA256 73a4a59e35863571281154449961ab2a81ff47c3baa341d7de100287a0043274
  • MD5 65171ebd8fd8c699770edee943ff09f1
  • SHA1 dc17dd3e384f06c03015b136cc068c2973673981
  • SHA512 f0f1c8a7dfa94feb7fc7e170ad4abfde9a4bc7d7af1a5c4cd763ca93484256a6a37fd5fb515345987af8daaedd812cfb3e0f5944ccdb0ee4983a0a71da53a144
  • SSDEEP 1536:02be3lIq1gxBdV5jNQpNwrZHHoVmbclOHoEah/B66z:0OEj1EV5oYdIV2cXhwk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  executionpersistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4