snakekeylogger | b18e1e1ca2d4f97f568e87e71ae9f0791821c2c4e2bb3385fa81b5829c1122b1

General

Target

b2aeb4b06aabde854d9d2ddf06424178.exe
Size

1.4MB
Sample

210120-gklezzbxqn
MD5

b2aeb4b06aabde854d9d2ddf06424178
SHA1

07258d08ec2d9dafbced67f3b7ebf60cdb76268a
SHA256

b18e1e1ca2d4f97f568e87e71ae9f0791821c2c4e2bb3385fa81b5829c1122b1
SHA512

d89ad16ecea89f51369f4189db3ba12d80ed14f6e6c5a18a245300a20cfd8db91ab4a0ea286dfe90a8d22b1a15caf4d4aba818a14e35513e2bd52b9e90689482

Score

10^/10

Malware Config

Targets

- Target
  
  b2aeb4b06aabde854d9d2ddf06424178.exe
- Size
  
  1.4MB
- MD5
  
  b2aeb4b06aabde854d9d2ddf06424178
- SHA1
  
  07258d08ec2d9dafbced67f3b7ebf60cdb76268a
- SHA256
  
  b18e1e1ca2d4f97f568e87e71ae9f0791821c2c4e2bb3385fa81b5829c1122b1
- SHA512
  
  d89ad16ecea89f51369f4189db3ba12d80ed14f6e6c5a18a245300a20cfd8db91ab4a0ea286dfe90a8d22b1a15caf4d4aba818a14e35513e2bd52b9e90689482
Score

10^/10

snakekeylogger keylogger ransomware spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger Payload
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices
  Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Targets

Snake Keylogger

Snake Keylogger Payload

Executes dropped EXE

Drops startup file

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Looks up external IP address via web service

Enumerates physical storage devices

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2