Overview

overview

10

Static

static

3

Payment Copy.exe

windows7-x64

10

Payment Copy.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2d360632d5fc9da917a0a42950e6bbe150a19ec7cb6d6ba7520e173c5f3f0538

  • Size

    617KB

  • Sample

    240707-hcs46syckc

  • MD5

    397f103d7fa01548cb11b0aa567e328c

  • SHA1

    cc8e067023d7e1de3184d2db219fdd279d51bdfb

  • SHA256

    2d360632d5fc9da917a0a42950e6bbe150a19ec7cb6d6ba7520e173c5f3f0538

  • SHA512

    d84e50e548bd7bc28ff4a2ca7ad2deaaf62a727c2f822140c68e6815162c8cbf59d66cd6b325dbd20db3b6b6ec1cf69da9a8cada4cbe2bd552026e9848b2999a

  • SSDEEP

    12288:OuseUDnNXyiHfcSIFLDGPIEvwqurzEKku70v9F4oZOe8Fl:ODdHfumfzu01PZOeul

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      Payment Copy.exe

    • Size

      740KB

    • MD5

      eb3d064d6075848f9477f4babd34ee6a

    • SHA1

      168e2497e77fae7de19e89458b33acc32371d905

    • SHA256

      6cfb5c2cba6ba8911866c3391977ab0c518c3154c749c5fea23a135488931e32

    • SHA512

      c7a25725bc5c5737aa59528aa7a1a52d35effb4175cf3afac6a515e9be7cd3b6993e041c184ce03d1a588da6141b216f1a095817dea0adfbc2cbc9c6234fcfa0

    • SSDEEP

      12288:gRtsaKRa5x6pZEZNr49YEtE63vRBksE3/Na+sxcgxmn52hREYuzlVr:7k5kLEZNXWZ3ZMhNn52YPR

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks