Overview

overview

10

Static

static

3

Faktura VA... .scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14042025_0802_FakturaVATnrFS254T00169_pdf.scr.iso

  • Size

    90KB

  • Sample

    250414-j2r4vasl16

  • MD5

    43e448d9112e99d3391f2f68fa9668d8

  • SHA1

    c04f64a078f255a6d5346298905dde2ab21586cb

  • SHA256

    9d7e399e893fb12e76fe6884bbddddd62199748054e08062d85190d860caebf0

  • SHA512

    1f998ea5f57731b480fe53a0d842f484f1c5112ab52c45697aaf5afc7e344cff045136b079e566b697ee0ff137928f1365a046170e62b37eeccde684e0742d6f

  • SSDEEP

    768:rl56Om/sAb0BgmhQ2mEF0KSCdgKk0Dqo0jgWDu01L3x+1ga:f69EAwBgmhQ2mEF0skC6dc1ga

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot7949470700:AAFn2qNN6gr70Yu8GL1tjixCC59lH1vIsb4/sendMessage?chat_id=1018401531

Targets

    • Target

      Faktura VAT nr FS254T00169_pdf .scr

    • Size

      30KB

    • MD5

      27b1ddaf62cfcdf4c43b4c6cff03e2b2

    • SHA1

      11b0cb163c84530b8d46cf826f331435c61e11c5

    • SHA256

      05b8fb268ef66034d4922652457db7e388b39213886e368611c4a1f994773349

    • SHA512

      7a6733f2ceda906c9ed27e51757a01595160bd420f5b4a96c9cd943cc3b65ddba9d5ec14d764ca23f121757c5607c3840b0fbef9a4be4c2c27c3f346766fde69

    • SSDEEP

      768:Z56Om/sAb0BgmhQ2mEF0KSCdgKk0Dqo0jgWDu01L3x+1ga:H69EAwBgmhQ2mEF0skC6dc1ga

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Snakekeylogger family

      snakekeylogger

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks