snakekeylogger | 9d2722eed882f96fbe2c0cab9297cd0f8b180add761b034be81ebbed18acb33a

General

Target

02072024_0208_01072024_Bank slip.docx
Size

16KB
Sample

240702-ck17vswdkn
MD5

d23ad6c57a2e42bc4d01a63c7957047a
SHA1

0e6de0feaa8e9471395943675fdd2da07576c1bd
SHA256

9d2722eed882f96fbe2c0cab9297cd0f8b180add761b034be81ebbed18acb33a
SHA512

63fb9186a83f9c917ad110f986deb08fb36b4eaa3a254f4c421a55a85b21c6c976ac54ad41f0781095cc8125119838a489ad218bd274025a1a917b398392aa50
SSDEEP

384:WyXHNatWqs8PL8wi4OEwH8TIbE91r2fRqJY8cviCv4zxUBZ72:WcHqx5P3DOqnYJUYvrv4lx

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.artefes.com
Port:
587
Username:
[email protected]
Password:
ArtEfes4765*+

Targets

- Target
  
  02072024_0208_01072024_Bank slip.docx
- Size
  
  16KB
- MD5
  
  d23ad6c57a2e42bc4d01a63c7957047a
- SHA1
  
  0e6de0feaa8e9471395943675fdd2da07576c1bd
- SHA256
  
  9d2722eed882f96fbe2c0cab9297cd0f8b180add761b034be81ebbed18acb33a
- SHA512
  
  63fb9186a83f9c917ad110f986deb08fb36b4eaa3a254f4c421a55a85b21c6c976ac54ad41f0781095cc8125119838a489ad218bd274025a1a917b398392aa50
- SSDEEP
  
  384:WyXHNatWqs8PL8wi4OEwH8TIbE91r2fRqJY8cviCv4zxUBZ72:WcHqx5P3DOqnYJUYvrv4lx
Score

10^/10

snakekeylogger collection execution keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Abuses OpenXML format to download file from external location
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Abuses OpenXML format to download file from external location

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2