Overview

overview

10

Static

static

1

DHL Invoic...df.exe

windows7_x64

7

DHL Invoic...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL Invoice Details_pdf.exe

  • Size

    439KB

  • Sample

    210617-dmn6r26d7x

  • MD5

    b65da38c0e35fe94a335c21e0c636c5d

  • SHA1

    abe45f712c1670cdecc9a800ff9523ce044efd39

  • SHA256

    64155fff003f28e4a1de683141d2140b4160b01bbba6365dfd017f622dabdcf7

  • SHA512

    3f1956073beb8c295c144707df565ca7f14fa4f36e49b394dcc0ed5158a99364375983ff57869f67a38e2da9dc254c0b908f5ab77f73f674480ad5692c587e92

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    gmicaprelam.in
  • Port:
    587
  • Username:
    designer@gmicaprelam.in
  • Password:
    designer2424@

Targets

    • Target

      DHL Invoice Details_pdf.exe

    • Size

      439KB

    • MD5

      b65da38c0e35fe94a335c21e0c636c5d

    • SHA1

      abe45f712c1670cdecc9a800ff9523ce044efd39

    • SHA256

      64155fff003f28e4a1de683141d2140b4160b01bbba6365dfd017f622dabdcf7

    • SHA512

      3f1956073beb8c295c144707df565ca7f14fa4f36e49b394dcc0ed5158a99364375983ff57869f67a38e2da9dc254c0b908f5ab77f73f674480ad5692c587e92

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger Payload

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks