snakekeylogger | 5ef92223b42a4e57547eb2adce7d2bca048a5a8c5ecf54ae5bd2ce630bb5ae53

General

Target
777777777.exe
Size 5KB
Sample210930-sf7f3saaa5
SHA256 5ef92223b42a4e57547eb2adce7d2bca048a5a8c5ecf54ae5bd2ce630bb5ae53
MD5 65253b0ae6233f24ffe1f21f1a0283e3
SHA1 9c85c2296af5c82b4795b8394864e6cac176b9b3
SHA512 44615f21118b2b39a5e0691aea81aa7983409f0460a0ccb77118744f999b7af7230b9443712497ebd2ce852fcb539f57f10854cb04b811062f612a801ac27d79
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
mail.okurmakina.com.tr
Port
587
Username
[email protected]
Password
Oi.4793

Targets

- Target
  777777777.exe
- Size 5KB
- SHA256 5ef92223b42a4e57547eb2adce7d2bca048a5a8c5ecf54ae5bd2ce630bb5ae53
- MD5 65253b0ae6233f24ffe1f21f1a0283e3
- SHA1 9c85c2296af5c82b4795b8394864e6cac176b9b3
- SHA512 44615f21118b2b39a5e0691aea81aa7983409f0460a0ccb77118744f999b7af7230b9443712497ebd2ce852fcb539f57f10854cb04b811062f612a801ac27d79
- MD5 SHA1 SHA512
Score

10^/10

snakekeylogger keylogger persistence stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Downloads MZ/PE file
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Downloads MZ/PE file

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2