snakekeylogger | 4a3e7e5e655ad7c52be676611a813bbf1430006a3045f3b5c90bfc9cc2320b30

Sharing

Copy URL

Twitter E-mail

General

Target

4a3e7e5e655ad7c52be676611a813bbf1430006a3045f3b5c90bfc9cc2320b30.exe
Size

213KB
Sample

240627-bm9rcaxelj
MD5

3cad1815879b2ca1fe7f2c5ea0f93fc3
SHA1

a66382098a770467ebe22de0d577ca2cc195dd9a
SHA256

4a3e7e5e655ad7c52be676611a813bbf1430006a3045f3b5c90bfc9cc2320b30
SHA512

99fab19b82d6e3a1d072dc42e6ca28c9f70835ba1a26eb1fd668ef1aa2ca1bce283392fa994d98c2988568f4e5e3685ffdaecfe4e1340e3b734798f0fc51ec5c
SSDEEP

3072:lop0LHINQBVU4Wr1m9s+NNx6PQ8bSncr1cKffB+TQ9D+2fE6vrxo91mLEBnFisgV:ygINQ7UL89sSnmcKffEsrfx8odj

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
webmail.valleycountysar.org
Port:
465
Username:
[email protected]
Password:
DKw(r0%wpbd]

https://api.telegram.org/bot6423203356:AAHYCiyPKTABZ0i87OeKnARFW967YOfRPUE/sendMessage?chat_id=7009913093

Targets

- Target
  
  4a3e7e5e655ad7c52be676611a813bbf1430006a3045f3b5c90bfc9cc2320b30.exe
- Size
  
  213KB
- MD5
  
  3cad1815879b2ca1fe7f2c5ea0f93fc3
- SHA1
  
  a66382098a770467ebe22de0d577ca2cc195dd9a
- SHA256
  
  4a3e7e5e655ad7c52be676611a813bbf1430006a3045f3b5c90bfc9cc2320b30
- SHA512
  
  99fab19b82d6e3a1d072dc42e6ca28c9f70835ba1a26eb1fd668ef1aa2ca1bce283392fa994d98c2988568f4e5e3685ffdaecfe4e1340e3b734798f0fc51ec5c
- SSDEEP
  
  3072:lop0LHINQBVU4Wr1m9s+NNx6PQ8bSncr1cKffB+TQ9D+2fE6vrxo91mLEBnFisgV:ygINQ7UL89sSnmcKffEsrfx8odj
Score

10^/10

snakekeylogger collection keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2