Overview

overview

10

Static

static

3

Faktura VA... .scr

windows7-x64

1

Faktura VA... .scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4a3366cf93759cb78a0ed525bfac3d7bbdf76cfba65517a8dcceefc074e29b61.img

  • Size

    94KB

  • Sample

    250201-dwnata1pdz

  • MD5

    8b074470cf822a033704ef777211919a

  • SHA1

    0c50c44383de6c4356810bc3b02c2c03882f139d

  • SHA256

    4a3366cf93759cb78a0ed525bfac3d7bbdf76cfba65517a8dcceefc074e29b61

  • SHA512

    f150543b19c349c488aa66f33098645fa1863de0e78c36a887901eea043d7424a498ab7ecfd26291737faf4804d002fda94e90faf7aae0dc65756cdc720ef7ba

  • SSDEEP

    768:Jh4tstdxqNvXA5IRBy47AtXKSgWDu01L3x+1gb:T4tstdx6vA5IRBXUm6dc1gb

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      Faktura VAT-FV2025011500091_pdf .scr

    • Size

      33KB

    • MD5

      d8d7f78fe5c20a6b352f07555596d52d

    • SHA1

      87c051d95e93ede211646eedc17558d105a73161

    • SHA256

      d63c8389d2b2cabed5b7c9a96a37199ef8509f21ea4c30907ef472a81703277b

    • SHA512

      9c40cd0bc0d434dc83ad7109c7ae2760303267e2b0e04ad405ebafece908e935d315655811ac951791d268c952661a7052fe85834da928b1bc5faaba5bed2f4d

    • SSDEEP

      768:e4tstdxqNvXA5IRBy47AtXKSgWDu01L3x+1gb:e4tstdx6vA5IRBXUm6dc1gb

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Snakekeylogger family

      snakekeylogger

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks