Overview

overview

10

Static

static

3

QUOTATION_...DF.scr

windows7-x64

10

QUOTATION_...DF.scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    43630c4b08bd18f7d7eb19d2af74c6d2be25a319587999c1ebe20494ad9adf03.z

  • Size

    1.2MB

  • Sample

    241207-czex6sxjgk

  • MD5

    5757258700bfab91b68b3966fa93ccc1

  • SHA1

    27fb04791e1ecaefeb136d2ad43f41601ac47553

  • SHA256

    43630c4b08bd18f7d7eb19d2af74c6d2be25a319587999c1ebe20494ad9adf03

  • SHA512

    901cadf94a0662654523289656ff2266e22807cc36183534a13cdd0c7a4f837f310b0537a889d4df79d9b6781945f4787520e00b8cc1cc618650137c25e67c1c

  • SSDEEP

    24576:Jm7+Kp4DPEuSDmU/5EmvtIO3vNyXcSsZCXdiLmwxXZwph+a:g+KFEUtIkFysnqdg5Yh+a

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      QUOTATION_DECQTRA071244PDF.scr

    • Size

      2.0MB

    • MD5

      e19319d88a7f8e0dfbcd9928c4bff63b

    • SHA1

      2279085cce4783d8c8a62c0f43c34887f106caae

    • SHA256

      3162982c3355757fb09a46661c92e2f1473d6d984ebfecd55ab282913b529dc0

    • SHA512

      d3b8953498d95d8ef55f443695aec1eafcbaeef1cdea7cd4e4266f3102f8ff7d4a0986e22ece31af4ed90c1f16d21b84f720e4bb0f31e7ef8cc1da02bf213e87

    • SSDEEP

      49152:8p3MJ2uSQldwu9mbTLbSEWA+oUbSyZDTL:8pBuRSu9YSH9V3ZD

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Snakekeylogger family

      snakekeylogger

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks