Overview

overview

10

Static

static

3

SOA.exe

windows7-x64

10

SOA.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_ad98ed194a2f4725dd6d6f3f3d661712

  • Size

    420KB

  • Sample

    250108-1cmaqstrcw

  • MD5

    ad98ed194a2f4725dd6d6f3f3d661712

  • SHA1

    1dbeb00de4402474714ba4e27ed67bc21c706def

  • SHA256

    e261d6e0552c3d6ad9323b586e7061246c3faa8d337286a3bffb459e7da2ac0c

  • SHA512

    8e61882c54700df65a901599154a36edd1cb5c1f016423e9c19bf4ebb773a9a6b0964df60b7cae2039b078f242d3b13895d91ddb2f5d70516e0876d60d8c6cc5

  • SSDEEP

    6144:S3S2qTxnLUcQeNLiOKdjeZEBIOJDJGVs7Rpkkv+IpIk8dwW1kskCer3Jy4238:/jQeqjeO6OJ86E4a33sk38

Score
10/10
snakekeyloggerdiscoverykeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      SOA.exe

    • Size

      445KB

    • MD5

      43f6b23871c444e83c21659cdf178432

    • SHA1

      3e36823c8c0559c999751c60108b92c94d1e01bc

    • SHA256

      ccb998b0a850d4c9cd99f43f12abe761606ebb47b2d2f010133825561abe79eb

    • SHA512

      73e84000f6aef2fcaafdbbdbebd55f87fa0bbac22cf63bb661f938a2cd48ed33c6e22e5cc67ff2500e7103a3546abc00af2afaaeaca662b84094c9e61b5d6bf8

    • SSDEEP

      6144:8GxhLHI5iv1zNXtHA0tMXgC/pN0LUkQpzY7twmHaqzJG/RN/:VwsXtHA0At//kQpMtDHaqzAT/

    Score
    10/10
    snakekeyloggerdiscoverykeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Snakekeylogger family

      snakekeylogger

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks