Overview

overview

10

Static

static

3

QUOTATION_...DF.scr

windows7-x64

10

QUOTATION_...DF.scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5757258700bfab91b68b3966fa93ccc1.bin

  • Size

    1.2MB

  • Sample

    241208-bl7wcszldj

  • MD5

    04d0c203f6a657913c968a322809e882

  • SHA1

    759df839c88ed5c073b79adbca63650750ece003

  • SHA256

    74416ac2d900f8577c0a1a4edc736a7ccc36515eb163bf4564d13c97b4f77f0a

  • SHA512

    1ec9f3c670e9bfcb939004b9cfbb4de4237cebd2fa0c9e51c838ab89051a043e1d7554ac19743d011531407a6512b61e4833a897b286aba26daa5f2184eb7ee4

  • SSDEEP

    24576:Yy4EZ227ZvJ2zaCkWuqCO3aLfF6gwkcrKcSS/09xOeHw5k2+IL9W:Yy4g227ZvJ2zaCk/oewgT6KcS3Xnwc

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      QUOTATION_DECQTRA071244PDF.scr

    • Size

      2.0MB

    • MD5

      e19319d88a7f8e0dfbcd9928c4bff63b

    • SHA1

      2279085cce4783d8c8a62c0f43c34887f106caae

    • SHA256

      3162982c3355757fb09a46661c92e2f1473d6d984ebfecd55ab282913b529dc0

    • SHA512

      d3b8953498d95d8ef55f443695aec1eafcbaeef1cdea7cd4e4266f3102f8ff7d4a0986e22ece31af4ed90c1f16d21b84f720e4bb0f31e7ef8cc1da02bf213e87

    • SSDEEP

      49152:8p3MJ2uSQldwu9mbTLbSEWA+oUbSyZDTL:8pBuRSu9YSH9V3ZD

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Snakekeylogger family

      snakekeylogger

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks