Overview

overview

10

Static

static

RFQ 100400...LY.exe

windows7_x64

10

RFQ 100400...LY.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RFQ 100400806 SUPPLY.exe

  • Size

    692KB

  • Sample

    210408-sgvflantpj

  • MD5

    0b6a32ecebc1b748e6c581969cd22f23

  • SHA1

    127095cc13cb9f8424ce1cea70cd96177da9b6fc

  • SHA256

    a2c53f24c2ab1da5772d43b5b5f2c70291e5d47fffc96fab67db326d8e34625a

  • SHA512

    64934e11a836325df4a4582f42719f31252e7f88d9f7f15abc5b645982ac3727e50e713eb373acd0b3fca0aea7dfaf7bb3733b499381878e43984172de157558

Score
10/10
snakekeyloggerkeyloggerspywarestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    mail.porathacorp.com
  • Port:
    587
  • Username:
    devarajan@porathacorp.com
  • Password:
    susila@22

Targets

    • Target

      RFQ 100400806 SUPPLY.exe

    • Size

      692KB

    • MD5

      0b6a32ecebc1b748e6c581969cd22f23

    • SHA1

      127095cc13cb9f8424ce1cea70cd96177da9b6fc

    • SHA256

      a2c53f24c2ab1da5772d43b5b5f2c70291e5d47fffc96fab67db326d8e34625a

    • SHA512

      64934e11a836325df4a4582f42719f31252e7f88d9f7f15abc5b645982ac3727e50e713eb373acd0b3fca0aea7dfaf7bb3733b499381878e43984172de157558

    Score
    10/10
    snakekeyloggerkeyloggerspywarestealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger Payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks