General

  • Target

    Order Details.exe

  • Size

    521KB

  • Sample

    240628-g5l1wsxhnn

  • MD5

    e6f8ab2ccb2e10d849ac4bb89170847c

  • SHA1

    047b54cec950a70eb566215dd3f72b86db7ee322

  • SHA256

    bba2d6408be82983ec789ae906451d2dffcba94c6d0d00b551725dc6085532d8

  • SHA512

    1ce9a85a789536494a5c005fd78d62a04ce10c55d627ff0aba9a36a8148302a6344692f27d7348af27cb08110f51dd08b1d6436cd4b5e404765a1c66e5131a1e

  • SSDEEP

    12288:c5kndm6oduitZWCxbLzRyCQZNcSpUbubuF4a0ZR9:Hng6oQiSCJM/LPtg4hZR9

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:
    smtp
  • Host:
    valleycountysar.org
  • Port:
    26
  • Username:
    [email protected]
  • Password:
    fY,FLoadtsiF

Targets

    • Target

      Order Details.exe

    • Size

      521KB

    • MD5

      e6f8ab2ccb2e10d849ac4bb89170847c

    • SHA1

      047b54cec950a70eb566215dd3f72b86db7ee322

    • SHA256

      bba2d6408be82983ec789ae906451d2dffcba94c6d0d00b551725dc6085532d8

    • SHA512

      1ce9a85a789536494a5c005fd78d62a04ce10c55d627ff0aba9a36a8148302a6344692f27d7348af27cb08110f51dd08b1d6436cd4b5e404765a1c66e5131a1e

    • SSDEEP

      12288:c5kndm6oduitZWCxbLzRyCQZNcSpUbubuF4a0ZR9:Hng6oQiSCJM/LPtg4hZR9

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks