Overview

overview

10

Static

static

3

faktura PL... .scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    faktura_PLN_11_242.83_pdf_________________________________________________________________.img

  • Size

    90KB

  • Sample

    250414-swsmvs1whz

  • MD5

    634f910cfdd4f4a911faaede71dbc1b7

  • SHA1

    d41cdc6f26d9c31f3ed12ddef94b03b759ec93c0

  • SHA256

    22b68a9da252f7bf1200cf9050c7492f7c8ec26f645119e22c64b64bce44ab96

  • SHA512

    91bce06a7ba4fcbbee280607c938e9abe4f8a8df1cc7b187c3f08bb4c3303ab6cf89a149ffd9d46a158e62b6cb77344d72bfbb22a4e599a199d6b68c04e30cab

  • SSDEEP

    768:gm56Om/sAb0BgmhQ2mEF0KSCdgKk0Dqo0jgWDu01L3x+1ga:169EAwBgmhQ2mEF0skC6dc1ga

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot7949470700:AAFn2qNN6gr70Yu8GL1tjixCC59lH1vIsb4/sendMessage?chat_id=1018401531

Targets

    • Target

      faktura PLN 11,242.83_pdf .scr

    • Size

      30KB

    • MD5

      27b1ddaf62cfcdf4c43b4c6cff03e2b2

    • SHA1

      11b0cb163c84530b8d46cf826f331435c61e11c5

    • SHA256

      05b8fb268ef66034d4922652457db7e388b39213886e368611c4a1f994773349

    • SHA512

      7a6733f2ceda906c9ed27e51757a01595160bd420f5b4a96c9cd943cc3b65ddba9d5ec14d764ca23f121757c5607c3840b0fbef9a4be4c2c27c3f346766fde69

    • SSDEEP

      768:Z56Om/sAb0BgmhQ2mEF0KSCdgKk0Dqo0jgWDu01L3x+1ga:H69EAwBgmhQ2mEF0skC6dc1ga

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Snakekeylogger family

      snakekeylogger

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks