Overview

overview

10

Static

static

3

Payment Copy.exe

windows7-x64

10

Payment Copy.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a27e182b447fdf32f2e0121f92cce6c426d133d239fb7de64e6ca773e5050b85.ace

  • Size

    617KB

  • Sample

    240706-kyq8tawbnf

  • MD5

    5dbf1ac07fcffb9a70963388b98982f6

  • SHA1

    4d1bb3d3f1b35b20d68e60ab437477c2d8972e45

  • SHA256

    a27e182b447fdf32f2e0121f92cce6c426d133d239fb7de64e6ca773e5050b85

  • SHA512

    c5f03431918956b2e216a2e86e7c6523cfc161d610c2101e7ca8611769c908bf75ccbe2f920a5f0374ee2d0f49e57a88f6b53dacfaf51a79375454dae69d4499

  • SSDEEP

    12288:16EaKBk3hnL4ZcHo3gi1XT9Tv0yoFBE5I3dDkSVvcE6uMy:oEaKuhLEcIQwXT9TvB8BE5IplVUE6U

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      Payment Copy.exe

    • Size

      740KB

    • MD5

      eb3d064d6075848f9477f4babd34ee6a

    • SHA1

      168e2497e77fae7de19e89458b33acc32371d905

    • SHA256

      6cfb5c2cba6ba8911866c3391977ab0c518c3154c749c5fea23a135488931e32

    • SHA512

      c7a25725bc5c5737aa59528aa7a1a52d35effb4175cf3afac6a515e9be7cd3b6993e041c184ce03d1a588da6141b216f1a095817dea0adfbc2cbc9c6234fcfa0

    • SSDEEP

      12288:gRtsaKRa5x6pZEZNr49YEtE63vRBksE3/Na+sxcgxmn52hREYuzlVr:7k5kLEZNXWZ3ZMhNn52YPR

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks