snakekeylogger | 2822066774b8c48e6b6d5ae494c680b553569b486f6c6211bb9118e209cb1a7a

General

Target

JaffaCakes118_c499233eb49c43969900aa38ded5b368
Size

558KB
Sample

250109-ler7fawlbz
MD5

c499233eb49c43969900aa38ded5b368
SHA1

3952f1f41264d943dc3594958cacbe818c3b26da
SHA256

2822066774b8c48e6b6d5ae494c680b553569b486f6c6211bb9118e209cb1a7a
SHA512

72f11c5286242fbd00db10ecd4ad22a6ec0ac8579fa47099bd781d0f3f0461fd1b59f99c2870b5669f59fe9deb2edf96e4715e586a5858836ac45cc0786573e5
SSDEEP

12288:hZe2H+3UqENc4nrYqM7SSMr2msYhtiYeMHKAdK414xY+:re2ehGrYW6wDdz4

Score

10^/10

Malware Config

Targets

- Target
  
  JaffaCakes118_c499233eb49c43969900aa38ded5b368
- Size
  
  558KB
- MD5
  
  c499233eb49c43969900aa38ded5b368
- SHA1
  
  3952f1f41264d943dc3594958cacbe818c3b26da
- SHA256
  
  2822066774b8c48e6b6d5ae494c680b553569b486f6c6211bb9118e209cb1a7a
- SHA512
  
  72f11c5286242fbd00db10ecd4ad22a6ec0ac8579fa47099bd781d0f3f0461fd1b59f99c2870b5669f59fe9deb2edf96e4715e586a5858836ac45cc0786573e5
- SSDEEP
  
  12288:hZe2H+3UqENc4nrYqM7SSMr2msYhtiYeMHKAdK414xY+:re2ehGrYW6wDdz4
Score

10^/10

snakekeylogger discovery keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Snakekeylogger family
  snakekeylogger
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/ggnqrpre.dll
- Size
  
  34KB
- MD5
  
  03a8f90a8788ca604fd74aa23342054a
- SHA1
  
  639d143761beebb8d303b032548f1a3cc287cc71
- SHA256
  
  70a80f42f241fb0631e6becf5ee849af2752fae5516baa82e998b69f44770d4b
- SHA512
  
  cfaec2f3efec01515f7ddf11526d09da8da9a2edf20a6e7331e263e331a434c0aac9de9ef72bb0827c9247b6847912ef97f50d1b76d3050b30174afdf77a8e4d
- SSDEEP
  
  384:okXnOdRSMRgjjfRE+qhWd2acwMW3JNspdpvA/C3r61tUQ0ui/+r:ord1Rgjj5vXd2aBMW3JN8k/2r6Hu/
Score

10^/10

snakekeylogger discovery keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Snakekeylogger family
  snakekeylogger
- Blocklisted process makes network request
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Snake Keylogger

Snake Keylogger payload

Snakekeylogger family

Loads dropped DLL

Looks up external IP address via web service

Suspicious use of SetThreadContext

Snake Keylogger

Snake Keylogger payload

Snakekeylogger family

Blocklisted process makes network request

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4