Overview

overview

10

Static

static

3

0f366aa151...18.exe

windows7-x64

10

0f366aa151...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f366aa151dc3a310fea6ee7255bc84c_JaffaCakes118

  • Size

    488KB

  • Sample

    240625-xx5e9sxfje

  • MD5

    0f366aa151dc3a310fea6ee7255bc84c

  • SHA1

    7ad3194bc5b49398bac1ecae4ea8b95d39f0af4e

  • SHA256

    8481677369aef0cd9d9fcbebe2a8f52916e4532666b1ea8e02eb046a0fa40409

  • SHA512

    92fa52a6c28643e4e359671f17e9826be63ef4a578407ca9f7db24d1b2439caf597252ae7803e5794bc888a3f2d7a6554096f1d8999aa00d0dde238dd84f3908

  • SSDEEP

    6144:cSDMpra6ePFXgZ3xlZPdAmDCNmRaWtTCbvr:ep1etuPAECNmRawTS

Score
10/10
snakekeyloggercollectionexecutionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    mail.potagrup.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Pgrup@2021

Targets

    • Target

      0f366aa151dc3a310fea6ee7255bc84c_JaffaCakes118

    • Size

      488KB

    • MD5

      0f366aa151dc3a310fea6ee7255bc84c

    • SHA1

      7ad3194bc5b49398bac1ecae4ea8b95d39f0af4e

    • SHA256

      8481677369aef0cd9d9fcbebe2a8f52916e4532666b1ea8e02eb046a0fa40409

    • SHA512

      92fa52a6c28643e4e359671f17e9826be63ef4a578407ca9f7db24d1b2439caf597252ae7803e5794bc888a3f2d7a6554096f1d8999aa00d0dde238dd84f3908

    • SSDEEP

      6144:cSDMpra6ePFXgZ3xlZPdAmDCNmRaWtTCbvr:ep1etuPAECNmRawTS

    Score
    10/10
    snakekeyloggercollectionexecutionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Drops startup file

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks