Overview

overview

10

Static

static

3

PRODUCTS LIST.pdf.exe

windows7-x64

10

PRODUCTS LIST.pdf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PRODUCTS LIST.pdf.exe

  • Size

    541KB

  • Sample

    240627-jhhq3asakl

  • MD5

    32c4e05aa7f5a3db58952fc06a00431d

  • SHA1

    db05864bb7349e3e4cb35d51a03c7110d049fa8f

  • SHA256

    a745afdd5cb81567de1560ead34145f713b7894058aa2097d755bf5d09b9d34f

  • SHA512

    88880e24e35ca74001b9e20599c8bab3f11f37b200d14517a2a985adbc0f20247538c5d2646d2f6bdaac4d72fbb35f36e38ea5386c323d4b0881ddd7b4c52f3f

  • SSDEEP

    12288:l99glhxbCawPRlsp8UQnF6mYlBNS61kf4mQKBWQ2:lGwJH5nEtS61MnQKBWQ2

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      PRODUCTS LIST.pdf.exe

    • Size

      541KB

    • MD5

      32c4e05aa7f5a3db58952fc06a00431d

    • SHA1

      db05864bb7349e3e4cb35d51a03c7110d049fa8f

    • SHA256

      a745afdd5cb81567de1560ead34145f713b7894058aa2097d755bf5d09b9d34f

    • SHA512

      88880e24e35ca74001b9e20599c8bab3f11f37b200d14517a2a985adbc0f20247538c5d2646d2f6bdaac4d72fbb35f36e38ea5386c323d4b0881ddd7b4c52f3f

    • SSDEEP

      12288:l99glhxbCawPRlsp8UQnF6mYlBNS61kf4mQKBWQ2:lGwJH5nEtS61MnQKBWQ2

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks