RFQ 100400806 SUPPLY.exe

General
Target

RFQ 100400806 SUPPLY.exe

Size

692KB

Sample

210408-sgvflantpj

Score
10 /10
MD5

0b6a32ecebc1b748e6c581969cd22f23

SHA1

127095cc13cb9f8424ce1cea70cd96177da9b6fc

SHA256

a2c53f24c2ab1da5772d43b5b5f2c70291e5d47fffc96fab67db326d8e34625a

SHA512

64934e11a836325df4a4582f42719f31252e7f88d9f7f15abc5b645982ac3727e50e713eb373acd0b3fca0aea7dfaf7bb3733b499381878e43984172de157558

Malware Config

Extracted

Family snakekeylogger
Credentials

Protocol: smtp

Host: mail.porathacorp.com

Port: 587

Username: devarajan@porathacorp.com

Password: susila@22

Targets
Target

RFQ 100400806 SUPPLY.exe

MD5

0b6a32ecebc1b748e6c581969cd22f23

Filesize

692KB

Score
10 /10
SHA1

127095cc13cb9f8424ce1cea70cd96177da9b6fc

SHA256

a2c53f24c2ab1da5772d43b5b5f2c70291e5d47fffc96fab67db326d8e34625a

SHA512

64934e11a836325df4a4582f42719f31252e7f88d9f7f15abc5b645982ac3727e50e713eb373acd0b3fca0aea7dfaf7bb3733b499381878e43984172de157558

Tags

Signatures

  • Snake Keylogger

    Description

    Keylogger and Infostealer first seen in November 2020.

    Tags

  • Snake Keylogger Payload

  • Reads user/profile data of local email clients

    Description

    Email clients store some user data on disk where infostealers will often target it.

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                Privilege Escalation
                  Tasks