snakekeylogger | f260c80e685986ac80122c63fcc494891baf4d688668da8f7fa11e38d7f8d1b8

General

Target
DHL AWB# 4AB19037XXX.pdf.exe
Size 5KB
Sample210929-g4xe8sdge6
SHA256 f260c80e685986ac80122c63fcc494891baf4d688668da8f7fa11e38d7f8d1b8
MD5 ad181efe9f33f0368cbdf5447814a748
SHA1 b212b79c3a934c54765adc0c1e1715835d1a61bd
SHA512 d46d0b0a87a0488bb09556d65ef150a21ec725828dbfd7e4fbf09fdd8061d3a7f390ff63a21326575a637fd7a2c3ce1b35583a2f39d71c31b47d85492d500268
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
smtp.alicoandsons.com
Port
587
Username
[email protected]
Password
Usman12345

Targets

- Target
  DHL AWB# 4AB19037XXX.pdf.exe
- Size 5KB
- SHA256 f260c80e685986ac80122c63fcc494891baf4d688668da8f7fa11e38d7f8d1b8
- MD5 ad181efe9f33f0368cbdf5447814a748
- SHA1 b212b79c3a934c54765adc0c1e1715835d1a61bd
- SHA512 d46d0b0a87a0488bb09556d65ef150a21ec725828dbfd7e4fbf09fdd8061d3a7f390ff63a21326575a637fd7a2c3ce1b35583a2f39d71c31b47d85492d500268
- MD5 SHA1 SHA512
Score

10^/10

snakekeylogger keylogger persistence stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Downloads MZ/PE file
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Downloads MZ/PE file

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2