General

  • Target

    JaffaCakes118_e7bb702825c89b2f4b4f9007aea956594896d9da5572331f2dc52e7274f2b2c7

  • Size

    152KB

  • Sample

    241224-l22pdsvjdw

  • MD5

    2a49422ad9bff4f587a760202174d9cf

  • SHA1

    5dbabaa2c46ef1086de0f7310b79a00e62602d66

  • SHA256

    e7bb702825c89b2f4b4f9007aea956594896d9da5572331f2dc52e7274f2b2c7

  • SHA512

    c50e610023640143a01339b038afc0057309fb112666dc3e1d3f10238d45364b20d75598f0682ea383293a2bbaef93ed4161e226dac178a9a79fb1afdaa43d02

  • SSDEEP

    3072:YFu/QTqOn4RBvx2IowFhxbCaUldwBRPnbYpPN2iJCQCv:xNfkIhbIlqvbiFJhG

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5273807869:AAHdhflfgTbp8lRJ0nhI2erbz0crK0sBFlM/sendMessage?chat_id=1212297121

Targets

    • Target

      JaffaCakes118_e7bb702825c89b2f4b4f9007aea956594896d9da5572331f2dc52e7274f2b2c7

    • Size

      152KB

    • MD5

      2a49422ad9bff4f587a760202174d9cf

    • SHA1

      5dbabaa2c46ef1086de0f7310b79a00e62602d66

    • SHA256

      e7bb702825c89b2f4b4f9007aea956594896d9da5572331f2dc52e7274f2b2c7

    • SHA512

      c50e610023640143a01339b038afc0057309fb112666dc3e1d3f10238d45364b20d75598f0682ea383293a2bbaef93ed4161e226dac178a9a79fb1afdaa43d02

    • SSDEEP

      3072:YFu/QTqOn4RBvx2IowFhxbCaUldwBRPnbYpPN2iJCQCv:xNfkIhbIlqvbiFJhG

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Snakekeylogger family

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks