Overview

overview

10

Static

static

ORDER PO-1...21.exe

windows7_x64

10

ORDER PO-1...21.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ORDER PO-168-05102021.exe

  • Size

    961KB

  • Sample

    210511-kbxzs1nq62

  • MD5

    06b47a4bc32b50a53e51ed01036f60aa

  • SHA1

    7c999525e123af1373e3db8e297550e220ae0a50

  • SHA256

    3757c869c9c4e311a526cce16364a47e2a286006f863ff19f5fe3cc1ae289cee

  • SHA512

    004f0eaae350c78aaecc07c39b66708f1df7478d1752f1a4cde17969f22630e0f67686d6680afe1b949a9ecd092f4b8bd8caf05b886dcfd8fab468baab87e510

Score
10/10
snakekeyloggerkeyloggerspywarestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    smtp.ionos.com
  • Port:
    587
  • Username:
    office@airtechair.net
  • Password:
    Airtech2010@

Targets

    • Target

      ORDER PO-168-05102021.exe

    • Size

      961KB

    • MD5

      06b47a4bc32b50a53e51ed01036f60aa

    • SHA1

      7c999525e123af1373e3db8e297550e220ae0a50

    • SHA256

      3757c869c9c4e311a526cce16364a47e2a286006f863ff19f5fe3cc1ae289cee

    • SHA512

      004f0eaae350c78aaecc07c39b66708f1df7478d1752f1a4cde17969f22630e0f67686d6680afe1b949a9ecd092f4b8bd8caf05b886dcfd8fab468baab87e510

    Score
    10/10
    snakekeyloggerkeyloggerspywarestealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger Payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks