snakekeylogger | aacc4ffd4879c92125c613f8a8abd7ab81789581d2305e162efbca3ce23ac180 | Triage

Submit
Reports

Overview

overview

Static

static

3

ae20ae4b8b...18.exe

windows7-x64

ae20ae4b8b...18.exe

windows10-2004-x64

Sharing

General

Target

ae20ae4b8b36170ee0fb8654902d962e_JaffaCakes118
Size

811KB
Sample

241129-bgxjtsxlhz
MD5

ae20ae4b8b36170ee0fb8654902d962e
SHA1

bd1900f3400bb00b62241f806e10296a783e289c
SHA256

aacc4ffd4879c92125c613f8a8abd7ab81789581d2305e162efbca3ce23ac180
SHA512

382970ddee385fbbb1e96f2df38ecc69cb1ee2b57a356f374b1e1c88c26db17d5401c1eece3a6c3cd7c3f7b624937187aa83c81c59d14991cd1e428d713bf0ea
SSDEEP

12288:Ebq1otKYmdoaRQ44M7wDEmqBRzOyZ+9iW6ZgHK7zXzKboFryF:aq1JYqdRZFKEfDZ+Yn3Kboo

Score

10^/10

snakekeylogger discovery keylogger stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

ae20ae4b8b36170ee0fb8654902d962e_JaffaCakes118.exe

Resource

win7-20240729-en

snakekeylogger discovery keylogger stealer

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

ae20ae4b8b36170ee0fb8654902d962e_JaffaCakes118.exe

Resource

win10v2004-20241007-en

snakekeylogger discovery keylogger stealer

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.rainspor.com
Port:
587
Username:
assad@rainspor.com
Password:
assad123assad
Email To:
assad@rainspor.com

Targets

- Target
  
  ae20ae4b8b36170ee0fb8654902d962e_JaffaCakes118
- Size
  
  811KB
- MD5
  
  ae20ae4b8b36170ee0fb8654902d962e
- SHA1
  
  bd1900f3400bb00b62241f806e10296a783e289c
- SHA256
  
  aacc4ffd4879c92125c613f8a8abd7ab81789581d2305e162efbca3ce23ac180
- SHA512
  
  382970ddee385fbbb1e96f2df38ecc69cb1ee2b57a356f374b1e1c88c26db17d5401c1eece3a6c3cd7c3f7b624937187aa83c81c59d14991cd1e428d713bf0ea
- SSDEEP
  
  12288:Ebq1otKYmdoaRQ44M7wDEmqBRzOyZ+9iW6ZgHK7zXzKboFryF:aq1JYqdRZFKEfDZ+Yn3Kboo
Score

10^/10

snakekeylogger discovery keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Snakekeylogger family
  snakekeylogger
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

snakekeyloggerdiscoverykeyloggerstealer

behavioral2

snakekeyloggerdiscoverykeyloggerstealer

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.