snakekeylogger | f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9

General

Target

f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
Size

563KB
Sample

240704-cmxx8a1crf
MD5

8c2f569ddc16f61e8c7b053cbd94f0b4
SHA1

585691bd7c15100b16bc3c49f94a9f9cf9c86477
SHA256

f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9
SHA512

ed3a9205c4df6c3531bfa974249face667414a4932862967254a83e0e63bdd7dc95fb79210636f023dd984e15dbc1e65a51226fc1ecfb08f1cbe3d3950d45ee0
SSDEEP

12288:aTOvjSANT3ukfoCJU0/Q0P3H0Nho+EHl00DE64MoQksBl7jMkZQV:aT2jFT3ukNJNPXQAHKeEXMx7Qmm

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.speedhouseoman.com
Port:
587
Username:
[email protected]
Password:
SpH@0084

Targets

- Target
  
  f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
- Size
  
  563KB
- MD5
  
  8c2f569ddc16f61e8c7b053cbd94f0b4
- SHA1
  
  585691bd7c15100b16bc3c49f94a9f9cf9c86477
- SHA256
  
  f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9
- SHA512
  
  ed3a9205c4df6c3531bfa974249face667414a4932862967254a83e0e63bdd7dc95fb79210636f023dd984e15dbc1e65a51226fc1ecfb08f1cbe3d3950d45ee0
- SSDEEP
  
  12288:aTOvjSANT3ukfoCJU0/Q0P3H0Nho+EHl00DE64MoQksBl7jMkZQV:aT2jFT3ukNJNPXQAHKeEXMx7Qmm
Score

10^/10

snakekeylogger collection execution keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2