Overview

overview

10

Static

static

3

FT_AR_9100...DF.scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11042025_0919_FT_AR_91007176_1.3.1.601_8042025_PDF.scr.iso

  • Size

    74KB

  • Sample

    250411-leqnlswjs9

  • MD5

    7c7c600f560209c45e6b912835114d68

  • SHA1

    2fe598f4ee33e5e36565d30b5b9408b94a54837e

  • SHA256

    449394ef79fc4e6a55c3dd024f094b25cc46a91e5bc73d384f0c1fae9bef7010

  • SHA512

    08dc4f760c85f5e817529b14e1811e55d0e2d67a9467515ff39f07bbb43bc645a982edf427bdf4e450b2936b4fb6bab011a22b7b27e520f8f94df8d8ab970538

  • SSDEEP

    384:NFNodJ716gLCiYT8NY3DrvnmHFyOiV//f3ZXwSuRRImqv:NFU70xT8+zrM6xXBmjqv

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot8184970629:AAFVSpTOXamd-PnkKC57Q0MntmrKNTjJgkE/sendMessage?chat_id=7759263545

Targets

    • Target

      FT_AR_91007176_1.3.1.601_8042025_PDF.scr

    • Size

      13KB

    • MD5

      8f89c61f800c1785b53504906d7ab213

    • SHA1

      682b5b07598f566c8a83d1cd629ecc28a35956da

    • SHA256

      3f03f6212ce48527322d5eeb85ce582abac11a662a7439722e53bfe6a8ad608c

    • SHA512

      8542ddaca5ee7dadf21ff5be70e3a1c5bfc980a0bd98c88babd242428131cac745fa5768dfdfa62266734ece2b27f71b1f4de6428359fdd5cc6896bdd3c98ae8

    • SSDEEP

      384:YNodJ716gLCiYT8NY3DrvnmHFyOiV//f3ZXwSuRRImqv:YU70xT8+zrM6xXBmjqv

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Snakekeylogger family

      snakekeylogger

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix

Tasks