snakekeylogger | 194c843d5109edd9d14f1b459524dde024bd903d3e70616b9270263279b5416f

General

Target

194c843d5109edd9d14f1b459524dde024bd903d3e70616b9270263279b5416f.docx
Size

16KB
Sample

240705-bxm1bs1gkg
MD5

d5ab2de292b70d3a7f0fc16b236c325b
SHA1

b7e498349dae307fdf4d08dfb5de5eccba4ac3d5
SHA256

194c843d5109edd9d14f1b459524dde024bd903d3e70616b9270263279b5416f
SHA512

2a33a54389da5716021c2a3d181e27819d7c2bfcc4eb921fe4cbed4880b800901ee478f059c7f48375609e4e78f31874eeca5364df01d3fde49d9ef2744fe2ee
SSDEEP

384:IyXKW7AWss8PL8wi4OEwH8TIbE91r2fRMJYvvid4ejeaS:IcK/b5P3DOqnYJKuvs4ejI

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.ebizindia.com
Port:
587
Username:
[email protected]
Password:
Duro Mausam

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.ebizindia.com
Port:
587
Username:
[email protected]
Password:
Duro Mausam

Targets

- Target
  
  194c843d5109edd9d14f1b459524dde024bd903d3e70616b9270263279b5416f.docx
- Size
  
  16KB
- MD5
  
  d5ab2de292b70d3a7f0fc16b236c325b
- SHA1
  
  b7e498349dae307fdf4d08dfb5de5eccba4ac3d5
- SHA256
  
  194c843d5109edd9d14f1b459524dde024bd903d3e70616b9270263279b5416f
- SHA512
  
  2a33a54389da5716021c2a3d181e27819d7c2bfcc4eb921fe4cbed4880b800901ee478f059c7f48375609e4e78f31874eeca5364df01d3fde49d9ef2744fe2ee
- SSDEEP
  
  384:IyXKW7AWss8PL8wi4OEwH8TIbE91r2fRMJYvvid4ejeaS:IcK/b5P3DOqnYJKuvs4ejI
Score

10^/10

snakekeylogger collection execution keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Abuses OpenXML format to download file from external location
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Abuses OpenXML format to download file from external location

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2