Overview

overview

10

Static

static

INVOICE NO...df.exe

windows7_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3cb808f5875e0237286f074b2887d7df3357c2a5bd332ed91ebf6b97f2df1371

  • Size

    687KB

  • Sample

    210728-jt7fmc61tx

  • MD5

    6038c2f3cdb0d17918fc49a91a409dfb

  • SHA1

    d215fb6d1ff891c15ee1282a17aad79544a445a1

  • SHA256

    3cb808f5875e0237286f074b2887d7df3357c2a5bd332ed91ebf6b97f2df1371

  • SHA512

    97c2687140e19f48f92ff1bb4ede038bf29ecfe75303fd296ad5c6a97a70139b617daa4c11f13c014c3b1894382984a6487b898dfe14b117335aa9ecc5ced893

Score
10/10
snakekeyloggerkeyloggerspywarestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    25
  • Username:
    [email protected]
  • Password:
    BkKMmzZ1

Targets

    • Target

      INVOICE NOPYN160917A-pdf.exe

    • Size

      1.5MB

    • MD5

      2e4c84e9537be515d65b0bdd4d7f533a

    • SHA1

      3105f4f8144acff5bc394d71bbf2caa0512ad438

    • SHA256

      6dd20f1dac8777dde5b6e89fee5381be620203345520d0a6f2263fd1cf02e918

    • SHA512

      de901d33dc31cc4b9bcc6db0aba1fda65be0282b206fb26bf066c740808bf899cd26b63636746925574d1efbe917564a010eece6fbc247633069f0ffb3537dc4

    Score
    10/10
    snakekeyloggerkeyloggerspywarestealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks