General

  • Target

    22b0dcc30c169644100916d06c39328f35a546a5b4a55a196dcc4d2b6a8197de

  • Size

    630KB

  • Sample

    241115-wfzm1ssmem

  • MD5

    70289d25b830cd80af41120874eb1ee1

  • SHA1

    ac76af075b1dd893200d57e6e9a3f7b24d476488

  • SHA256

    22b0dcc30c169644100916d06c39328f35a546a5b4a55a196dcc4d2b6a8197de

  • SHA512

    40c245c8bc5cdfd169abc4e7daadc7f90493a27cda447f27d403552600a33a72f754c478495ca98259e071113f4521423d18bcf1cca7c70eae82216a48d4440f

  • SSDEEP

    12288:F3QiGR0dBOzDiCk5mQ0LnQyxzERfZ7sXmGUoFmz0WCJVMRsK:VoAOzHQ4nPzuZ7s27Im7CJVasK

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot7985379579:AAFFNXAHJz6n24A6xEGgMMms826UxvjorNA/sendMessage?chat_id=6370711846

Targets

    • Target

      22b0dcc30c169644100916d06c39328f35a546a5b4a55a196dcc4d2b6a8197de

    • Size

      630KB

    • MD5

      70289d25b830cd80af41120874eb1ee1

    • SHA1

      ac76af075b1dd893200d57e6e9a3f7b24d476488

    • SHA256

      22b0dcc30c169644100916d06c39328f35a546a5b4a55a196dcc4d2b6a8197de

    • SHA512

      40c245c8bc5cdfd169abc4e7daadc7f90493a27cda447f27d403552600a33a72f754c478495ca98259e071113f4521423d18bcf1cca7c70eae82216a48d4440f

    • SSDEEP

      12288:F3QiGR0dBOzDiCk5mQ0LnQyxzERfZ7sXmGUoFmz0WCJVMRsK:VoAOzHQ4nPzuZ7s27Im7CJVasK

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Snakekeylogger family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.