Overview

overview

10

Static

static

3

QUOTATION_...DF.scr

windows7-x64

10

QUOTATION_...DF.scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    97d8e645f346ddaf67cbe7359d333e3d454a5f791005c829d6efc236727a774a.z

  • Size

    1.0MB

  • Sample

    241127-damr6azlep

  • MD5

    5d391870d28e8f5ff8385cf05576ce2b

  • SHA1

    00078ced8b5ff028fa9c7c75bce510107a751dbd

  • SHA256

    97d8e645f346ddaf67cbe7359d333e3d454a5f791005c829d6efc236727a774a

  • SHA512

    81036353d13b582351ffb1623f2067c4992607b2082a8ec03290f59ea0b2576e39cad0c1876b867dc4fd3d1b8a2cf28864f7664f6989e194011c54d4ac4c4b81

  • SSDEEP

    24576:nZ/16gorpExvZ+qUP8HiFKCurYtMxy5vW1NtvDFWLFZzd:ZogopEpc77FKHr/cyNtvxWLFL

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      QUOTATION_NOVQTRA071244PDF.scr

    • Size

      1.4MB

    • MD5

      a7eb6d75e2e1650b770659935018365b

    • SHA1

      ea305bbda8b4a94cd46c85b322c058f52a3b41f5

    • SHA256

      bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb

    • SHA512

      3487eb0baf2ecb908f2edd65049e1ed0107c318bacb85755e51aa836268f50c7695759d0e165492bc20bbe808337e36b6daf25efb5f7abf4811c16baf6291f5b

    • SSDEEP

      24576:5eyolA3YuCbH7J2Urh6TEJ1Z3PYEAmje+LmSWGn0o5I2W+uJax08B:x3fq0UrhQEJ/MX+x0UIS

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Snakekeylogger family

      snakekeylogger

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks