snakekeylogger | 4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0

General

Target

4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
Size

826KB
Sample

240704-bsyahaxalp
MD5

68bcd11da168bcd33c61adfe6cf8b2b3
SHA1

2c1233fb5a6e73a8cf5b97248f771ca92f3776dc
SHA256

4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0
SHA512

9fdb2a0615a85354c6f1588e5ee2d8685b0d6f1e1d0913440090df9d704f87a84f5131fd978a0acfad2e46380b3b925907c57745b57b7466d6ee38c39b59b563
SSDEEP

12288:B61ODNf+wYk4ezUlsvU6PnfdLEoB+q0yJsIYScFpy7w88Uk8/6Tk976QCAxGXgXM:X4ezUqTRGpIYSupf8v/6Tkl6EGQgxN7

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.therealdealboattours.com
Port:
587
Username:
[email protected]
Password:
success$2022

Targets

- Target
  
  4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
- Size
  
  826KB
- MD5
  
  68bcd11da168bcd33c61adfe6cf8b2b3
- SHA1
  
  2c1233fb5a6e73a8cf5b97248f771ca92f3776dc
- SHA256
  
  4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0
- SHA512
  
  9fdb2a0615a85354c6f1588e5ee2d8685b0d6f1e1d0913440090df9d704f87a84f5131fd978a0acfad2e46380b3b925907c57745b57b7466d6ee38c39b59b563
- SSDEEP
  
  12288:B61ODNf+wYk4ezUlsvU6PnfdLEoB+q0yJsIYScFpy7w88Uk8/6Tk976QCAxGXgXM:X4ezUqTRGpIYSupf8v/6Tkl6EGQgxN7
Score

10^/10

snakekeylogger collection execution keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2