Overview

overview

10

Static

static

Consignmen...ls.exe

windows7_x64

1

Consignmen...ls.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Consignment Details.exe

  • Size

    3.0MB

  • Sample

    210511-cqbde69jqn

  • MD5

    13d99c2ac641f89128925263d6ddc4f4

  • SHA1

    3e68058db2a6da752fd3e711955bed24440d6471

  • SHA256

    55519e954b4b28f0d1497294eab96130c3932928fdf4a739c9a94a884379282f

  • SHA512

    8aef281d74bdb0da823c4c91855563e82bf6bbbaaeb88a528d06992b59feeae64f1f6fbf4dc49e2d5e6de8dcfd9cabc2654b6a3acc5f7c30628c4d8d9f8285c5

Score
10/10
snakekeyloggerkeyloggerspywarestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    gmicaprelam.in
  • Port:
    587
  • Username:
    shege@gmicaprelam.in
  • Password:
    shege2424@

Targets

    • Target

      Consignment Details.exe

    • Size

      3.0MB

    • MD5

      13d99c2ac641f89128925263d6ddc4f4

    • SHA1

      3e68058db2a6da752fd3e711955bed24440d6471

    • SHA256

      55519e954b4b28f0d1497294eab96130c3932928fdf4a739c9a94a884379282f

    • SHA512

      8aef281d74bdb0da823c4c91855563e82bf6bbbaaeb88a528d06992b59feeae64f1f6fbf4dc49e2d5e6de8dcfd9cabc2654b6a3acc5f7c30628c4d8d9f8285c5

    Score
    10/10
    snakekeyloggerkeyloggerspywarestealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger Payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks