Overview

overview

10

Static

static

10

5.exe

windows7-x64

10

5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5.exe

  • Size

    50KB

  • Sample

    240628-nt8h3sxepf

  • MD5

    a4ae05762502813b211f8a85ade4aaf9

  • SHA1

    d8ccccad0ec7dd9ada63a9b7b2f318d5c2bf7345

  • SHA256

    ff1a81ba33a6328568c2c3fa6c02d90909322624fd07c76d9fb300e56d47092a

  • SHA512

    4ec7b4063079e418d1b7a7d4a81bf823976fb22aa3011914420cd95b1a0f7a0a7b36e3b6a2edbb5395c11c71cbf800747fc2cdaea9fa5fe0ca6df0ee59041dff

  • SSDEEP

    768:hYkXQd1NrfaBQrpl21Ic6ehe9cy3i5j6Aw6/hnkz8IkOWHQki8T:O6Qr8QrMryp+WIhnO8jOWF

Score
10/10
purelogstealersnakekeyloggercollectionkeyloggerpersistencespywarestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      5.exe

    • Size

      50KB

    • MD5

      a4ae05762502813b211f8a85ade4aaf9

    • SHA1

      d8ccccad0ec7dd9ada63a9b7b2f318d5c2bf7345

    • SHA256

      ff1a81ba33a6328568c2c3fa6c02d90909322624fd07c76d9fb300e56d47092a

    • SHA512

      4ec7b4063079e418d1b7a7d4a81bf823976fb22aa3011914420cd95b1a0f7a0a7b36e3b6a2edbb5395c11c71cbf800747fc2cdaea9fa5fe0ca6df0ee59041dff

    • SSDEEP

      768:hYkXQd1NrfaBQrpl21Ic6ehe9cy3i5j6Aw6/hnkz8IkOWHQki8T:O6Qr8QrMryp+WIhnO8jOWF

    Score
    10/10
    purelogstealerstealersnakekeyloggercollectionkeyloggerpersistencespyware

    • PureLog Stealer

      PureLog Stealer is an infostealer written in C#.

      stealerpurelogstealer

    • PureLog Stealer payload

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks