Overview

overview

10

Static

static

3

Order Details.exe

windows7-x64

10

Order Details.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    28062024_1714_28062024_Order Details.zip

  • Size

    284KB

  • Sample

    240628-vsanzszgjj

  • MD5

    7d799666c280c0b6f4b67d4b09d855a9

  • SHA1

    f309338966c4daf8e3ea846bea41aad171668fbb

  • SHA256

    974b7939642577431e2f170042faa0e5c097dd99ffbd447b9e763e863db32ba8

  • SHA512

    5f3db9d312ac79e4ad7b767ba923b142431cdce730f61da4cf8ed5d66976e54b0115a2d1c3805bca6c1fe21a99f459b3e1646b692bc67d0c75f2e275c3f77d6b

  • SSDEEP

    6144:j+YMqIy74oc86Ii+IU+B7ONjYCd7BZhDw5OgmPFA:j+81oIiJ2KCzDwQ39A

Score
10/10
snakekeyloggercollectionkeyloggerspywarestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    valleycountysar.org
  • Port:
    26
  • Username:
    [email protected]
  • Password:
    fY,FLoadtsiF

Targets

    • Target

      Order Details.exe

    • Size

      521KB

    • MD5

      e6f8ab2ccb2e10d849ac4bb89170847c

    • SHA1

      047b54cec950a70eb566215dd3f72b86db7ee322

    • SHA256

      bba2d6408be82983ec789ae906451d2dffcba94c6d0d00b551725dc6085532d8

    • SHA512

      1ce9a85a789536494a5c005fd78d62a04ce10c55d627ff0aba9a36a8148302a6344692f27d7348af27cb08110f51dd08b1d6436cd4b5e404765a1c66e5131a1e

    • SSDEEP

      12288:c5kndm6oduitZWCxbLzRyCQZNcSpUbubuF4a0ZR9:Hng6oQiSCJM/LPtg4hZR9

    Score
    10/10
    snakekeyloggercollectionkeyloggerspywarestealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks