Overview

overview

10

Static

static

3

552e61ad61...aa.exe

windows7-x64

10

552e61ad61...aa.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    552e61ad619a32a252b5a7e52dfee9aff417040e147e34bf0111e3f89dc433aa.exe

  • Size

    1.1MB

  • Sample

    240701-bharfs1fpc

  • MD5

    65e2a9349c75ee34280992ed2e7aa548

  • SHA1

    d57c9017e2cbdb589c2698d899ee7f9063e35142

  • SHA256

    552e61ad619a32a252b5a7e52dfee9aff417040e147e34bf0111e3f89dc433aa

  • SHA512

    c9e75dc48d42b67cada4b0e91123439c39d1609f241c40e39b0e7461befc1f9016e1c0e13f4046f9c3556284e5ff7befbd810c1bdf48fa7744fe510678c07796

  • SSDEEP

    12288:7fioXCFj7X9WyhW9f1hL5JyqPY3dhaGIUZo6Pku:eoX4tWb1Jy/hvhK6Pt

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    valleycountysar.org
  • Port:
    26
  • Username:
    [email protected]
  • Password:
    fY,FLoadtsiF

Targets

    • Target

      552e61ad619a32a252b5a7e52dfee9aff417040e147e34bf0111e3f89dc433aa.exe

    • Size

      1.1MB

    • MD5

      65e2a9349c75ee34280992ed2e7aa548

    • SHA1

      d57c9017e2cbdb589c2698d899ee7f9063e35142

    • SHA256

      552e61ad619a32a252b5a7e52dfee9aff417040e147e34bf0111e3f89dc433aa

    • SHA512

      c9e75dc48d42b67cada4b0e91123439c39d1609f241c40e39b0e7461befc1f9016e1c0e13f4046f9c3556284e5ff7befbd810c1bdf48fa7744fe510678c07796

    • SSDEEP

      12288:7fioXCFj7X9WyhW9f1hL5JyqPY3dhaGIUZo6Pku:eoX4tWb1Jy/hvhK6Pt

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects executables packed with or use KoiVM

    • Detects executables referencing many email and collaboration clients. Observed in information stealers

    • Detects executables with potential process hoocking

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks