Overview

overview

10

Static

static

Consignment Doc.exe

windows7_x64

10

Consignment Doc.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Consignment Doc.exe

  • Size

    235KB

  • Sample

    210421-wfjqe7qfwj

  • MD5

    b65c7b2118c5e4d6ad903c82b15a4867

  • SHA1

    ad419df99d7e2519db823822db3b131cf4a0997f

  • SHA256

    b20aef6f59d2315f17622d3d7291bdd171539a7d8c56baa70c672c3ad234173d

  • SHA512

    7f2be934356c889869dd7c7e8f7e3022891b498da3cf4685c84eb49171d5ab74da27f4e98fe4cb7ba432172893428ef9d805abf234878cb5d1af6cae25c60b16

Score
10/10
snakekeyloggerkeyloggerspywarestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    gmicaprelam.in
  • Port:
    587
  • Username:
    shege@gmicaprelam.in
  • Password:
    shege2424@

Targets

    • Target

      Consignment Doc.exe

    • Size

      235KB

    • MD5

      b65c7b2118c5e4d6ad903c82b15a4867

    • SHA1

      ad419df99d7e2519db823822db3b131cf4a0997f

    • SHA256

      b20aef6f59d2315f17622d3d7291bdd171539a7d8c56baa70c672c3ad234173d

    • SHA512

      7f2be934356c889869dd7c7e8f7e3022891b498da3cf4685c84eb49171d5ab74da27f4e98fe4cb7ba432172893428ef9d805abf234878cb5d1af6cae25c60b16

    Score
    10/10
    snakekeyloggerkeyloggerspywarestealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger Payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks