Overview

overview

10

Static

static

3

7a1b1accd1...bc.exe

windows7-x64

10

7a1b1accd1...bc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    19987124505.zip

  • Size

    550KB

  • Sample

    241119-el8dnsvndp

  • MD5

    361150ca313425507e5407d02e129289

  • SHA1

    246578f86f313e8acefc6da270bbc2240b09c1e6

  • SHA256

    9d08ce65ad2e133eb8a64a6d5a2af33f726cd03b1e35304888d4fa2007ab96b1

  • SHA512

    dd7684611cab899f69658ae3454de72ef1389f9d3d8d8f2902489f6c5b326a3cad3fbf4265d750571886b3a2e00b3ccc75def0740ef7006a9b348a644a26507f

  • SSDEEP

    12288:uU3sX7/UsbPuoUa7l7c6PDTHZ5Zzt78vWwXJBeu4dh:T3y7fyxa+AX55Zzt78vNJSh

Score
10/10
snakekeyloggerdiscoveryexecutionkeyloggerstealer

Malware Config

Targets

    • Target

      7a1b1accd1cb42cb51060c603ca409ca6345a52035cc2a4cb356e42abd4df5bc

    • Size

      646KB

    • MD5

      5556070b7b98ac900b15008dc307f93b

    • SHA1

      58a09bf573b4b91ee7acb9915f85c45dbd8a9811

    • SHA256

      7a1b1accd1cb42cb51060c603ca409ca6345a52035cc2a4cb356e42abd4df5bc

    • SHA512

      8bdc68e2408c173d80abfcd234f063a3b54724d53676c10483b369b96948bcc5eace7c1c2ad6c487505b42392ab050b7adb316f7776ef4c02118e390dfefb05e

    • SSDEEP

      12288:gUxHU3TBLTyOYRSHrM65aj0iqPBxgWaRNo77Om6d4zp:gUxGLTyTRI34v7yp

    Score
    10/10
    snakekeyloggerdiscoveryexecutionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Snakekeylogger family

      snakekeylogger

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks