Overview

overview

10

Static

static

3

Order Details.exe

windows7-x64

10

Order Details.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    01072024_1117_30062024_Order Details.zip

  • Size

    480KB

  • Sample

    240701-nd22cs1hmm

  • MD5

    bd0e58c36902edcf231dc4c534a0e2d0

  • SHA1

    00c9a156d6373e90d38871e1cc5be6680efd2eae

  • SHA256

    7c5f0fa282017c5a44d59e8835d577096f8277d02954b1d649397e3f11851fb3

  • SHA512

    1e336c98ba8227c31362ee4bd7dce96c27cee380437231647e2a0bb216b82a44c95cad4537bccf01b35d6590f969ed622f94823a8dbc68a2a94eb401091e3c43

  • SSDEEP

    12288:+CFjB/ZK+Fc3R1hfFJyqjAdnhaGOUfIG/41zy:+0BKJPJyThBbwG/4Fy

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    valleycountysar.org
  • Port:
    26
  • Username:
    [email protected]
  • Password:
    fY,FLoadtsiF

Targets

    • Target

      Order Details.exe

    • Size

      1.1MB

    • MD5

      65e2a9349c75ee34280992ed2e7aa548

    • SHA1

      d57c9017e2cbdb589c2698d899ee7f9063e35142

    • SHA256

      552e61ad619a32a252b5a7e52dfee9aff417040e147e34bf0111e3f89dc433aa

    • SHA512

      c9e75dc48d42b67cada4b0e91123439c39d1609f241c40e39b0e7461befc1f9016e1c0e13f4046f9c3556284e5ff7befbd810c1bdf48fa7744fe510678c07796

    • SSDEEP

      12288:7fioXCFj7X9WyhW9f1hL5JyqPY3dhaGIUZo6Pku:eoX4tWb1Jy/hvhK6Pt

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks