snakekeylogger | f856e5403a24692155bcd90d75a5198e0d1d91e9e33f2609ec4305e1478b6cdd

General

Target

ff06a87dd0550386be1f780d560f1877.bin
Size

46KB
Sample

240703-ecyg4swcqf
MD5

3010e0df8deba35ee697028d21cd0251
SHA1

c33b8f9c5fbb3071b2526085d109ea2dba0f6fd0
SHA256

f856e5403a24692155bcd90d75a5198e0d1d91e9e33f2609ec4305e1478b6cdd
SHA512

2cc0e535be4a61f60ae399f2e4a4f33d35a4db39d28af77924185eb4af0f84a0dbe48e28931d954f1037ec1bdb06359974bb42c9ad7134e535b7edfc9dd82fbe
SSDEEP

768:mb+9yShEHfWQHElNpLt+kGSVwfaTFRrUrNzr7+Fye0dH5iiPBz2JGDI8B7j:T9/ShH8gkGSWfkCNX7+L0dwipzq6j

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.artefes.com
Port:
587
Username:
[email protected]
Password:
ArtEfes4765*+

Targets

- Target
  
  511c82313461b74fe24201d13dead6a280311d248062e09a465eb950502d1c18.doc
- Size
  
  415KB
- MD5
  
  ff06a87dd0550386be1f780d560f1877
- SHA1
  
  69e95738ec635520a508f7424a759261e5032cb0
- SHA256
  
  511c82313461b74fe24201d13dead6a280311d248062e09a465eb950502d1c18
- SHA512
  
  60e39f9628edbcb5118d53a2887c8f4879260d1d480a6a25960d58366fef2ca248b7115b521ff7de57c61063c1c35da0ac318fc22ad472b38b0cf34ecfd2534c
- SSDEEP
  
  6144:PGuqGuqGuqGuqGuqGuqGuqGuqGuqGuqGuVhG+qMh9c:xe
Score

10^/10

snakekeylogger collection execution keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2