General
- Target 2026-09-29_6151cefd951788e4d16fc6934ffc4973_andromeda_aspxspy_cobalt-strike_coinminer_dosia_eternalromance_glassworm_hacktools_hermeticwiper_hive_icedid_luca-stealer_mimikatz_ngrbot_njrat_poet-rat_pos_qilin_quasar-rat_redleaves_snatch_solarmarker_vidar
- Size 27.8MB
- Sample261001-yj5dsaba87
- SHA256 65c24abca5c8858c0d629b997b7eca722db6189da75d887109c7920c5c3f6b88
Score
10/10
Malware Config
Targets
-
- Target 2026-09-29_6151cefd951788e4d16fc6934ffc4973_andromeda_aspxspy_cobalt-strike_coinminer_dosia_eternalromance_glassworm_hacktools_hermeticwiper_hive_icedid_luca-stealer_mimikatz_ngrbot_njrat_poet-rat_pos_qilin_quasar-rat_redleaves_snatch_solarmarker_vidar
- Size 27.8MB
- SHA256 65c24abca5c8858c0d629b997b7eca722db6189da75d887109c7920c5c3f6b88
Score10/10-
Family: Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
-
Detects executables containing possible sandbox analysis VM usernames
-
Detects executables embedding command execution via IExecuteCommand COM object
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables referencing many IR and analysis tools
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
-
UPX dump on OEP (original entry point)
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.