Overview

overview

10

Static

static

3

JaffaCakes...3a.exe

windows7-x64

10

JaffaCakes...3a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_b053441618809b9dd77c5ebf50239c3a

  • Size

    634KB

  • Sample

    250108-2gf5yswngv

  • MD5

    b053441618809b9dd77c5ebf50239c3a

  • SHA1

    69fd352d0bfd639bee79691bda6428c0476c497b

  • SHA256

    01828be39e9c87bcfe2f59374c1dc5e9fb963bffcf3bf5a3d0bd3e82e6c27c32

  • SHA512

    32391e70680c0d2e2a37ff3bea5209e72b8a8af60af8a7e06625267d49d0e6a903887704b54cf543faeef45e687f79c00416425f86c43818b8ef56d035a50bfe

  • SSDEEP

    6144:pGxhLzIXav5wzU3oHY59KCvkg9yDUo1BfcnCMk+DI3D8+4Z2wwwxItGrKsPE7G:YMeis5X8gchB8CQGA+8OtGr

Score
10/10
snakekeyloggerdiscoverykeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials
C2

https://api.telegram.org/bot1620445910:AAF2v81NoINJsu_XXnpGet1YDm-NxnznaIE/sendMessage?chat_id=1063661839

Targets

    • Target

      JaffaCakes118_b053441618809b9dd77c5ebf50239c3a

    • Size

      634KB

    • MD5

      b053441618809b9dd77c5ebf50239c3a

    • SHA1

      69fd352d0bfd639bee79691bda6428c0476c497b

    • SHA256

      01828be39e9c87bcfe2f59374c1dc5e9fb963bffcf3bf5a3d0bd3e82e6c27c32

    • SHA512

      32391e70680c0d2e2a37ff3bea5209e72b8a8af60af8a7e06625267d49d0e6a903887704b54cf543faeef45e687f79c00416425f86c43818b8ef56d035a50bfe

    • SSDEEP

      6144:pGxhLzIXav5wzU3oHY59KCvkg9yDUo1BfcnCMk+DI3D8+4Z2wwwxItGrKsPE7G:YMeis5X8gchB8CQGA+8OtGr

    Score
    10/10
    snakekeyloggerdiscoverykeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Snakekeylogger family

      snakekeylogger

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks