Overview

overview

10

Static

static

Bank Trans...df.exe

windows7_x64

10

Bank Trans...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Bank Transfer-April Due pdf.exe

  • Size

    926KB

  • Sample

    210618-4kjwflgjxj

  • MD5

    1ba9f0cff517d4f42fd88857de31f27b

  • SHA1

    59f33cd5d80f850a6de452c026e6d937217b9cff

  • SHA256

    04253e566268069d633182f191b77a0f0f994d907da2f3512dbe344576baec06

  • SHA512

    d843ba0c998de4e068dcb728aea58d4d1511dcf71ccb6de92ef41c45abaa186e5dd49f347cbdf1298ca90a570328a4ff927dbf59c8f87aa4e5b22f4361b363e0

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    smtp.jrtlndia.com
  • Port:
    587
  • Username:
    tsadmin@jrtlndia.com
  • Password:
    CNGKwKI7

Targets

    • Target

      Bank Transfer-April Due pdf.exe

    • Size

      926KB

    • MD5

      1ba9f0cff517d4f42fd88857de31f27b

    • SHA1

      59f33cd5d80f850a6de452c026e6d937217b9cff

    • SHA256

      04253e566268069d633182f191b77a0f0f994d907da2f3512dbe344576baec06

    • SHA512

      d843ba0c998de4e068dcb728aea58d4d1511dcf71ccb6de92ef41c45abaa186e5dd49f347cbdf1298ca90a570328a4ff927dbf59c8f87aa4e5b22f4361b363e0

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger Payload

    • Uses the VBS compiler for execution

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks