General
- Target 840037df070b0605740447bad28789ed5ae419587901967261c631ff9ca73ca6
- Size 10.7MB
- Sample260929-gbfa9afb44
- SHA256 840037df070b0605740447bad28789ed5ae419587901967261c631ff9ca73ca6
Malware Config
Targets
-
- Target 1.0.3POFU0/Pofu_Win32.exe
- Size 4.6MB
- SHA256 2c45ed3b060d12ad74cab8bfa051b0910e899623f78aadb9207c782f87c24bdf
Score10/10-
Family: Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload
-
Modifies Windows Firewall
-
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Network Service Discovery
Attempt to gather information on host's network.
-
Network Share Discovery
Attempt to gather information on host network.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target 1.0.3POFU0/Pofu_Win64.exe
- Size 6.1MB
- SHA256 a231fc019c3f2d04005b69c00eba0052c2cf06e0dc0f542399c4dcb9845b22b8
Score10/10-
Family: Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload
-
Modifies Windows Firewall
-
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Network Service Discovery
Attempt to gather information on host's network.
-
Network Share Discovery
Attempt to gather information on host network.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Windows Command Shell
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Masquerading
1Match Legitimate Name or Location
1Modify Registry
1Discovery
Network Service Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
4System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Network Connections Discovery
1