General
-
Target
70016103621110.xlsm
-
Size
363KB
-
Sample
211019-n4faaagfel
-
MD5
998da072875302919b2819e018eacf6f
-
SHA1
4bcb248983c0a37842cfae2bb13dcd1e6bc98c87
-
SHA256
8aa3e1396cd5802e840d87a5a0b370e28102cbe41669124981aa3d38738099a7
-
SHA512
3192effb38fe5eee4498713e4021836700067a659a869ece23ade0881fcf454c86dd5c559fa7dd1c2e5a8628a108083ac78a9a08e1b876e8f895a6bd9f5734a0
Malware Config
Extracted
http://3.64.251.139/v3/2/70016103621110.exe
Extracted
snakekeylogger
Protocol: smtp- Host:
efinancet.shop - Port:
587 - Username:
[email protected] - Password:
BG##kz5dHzND
Targets
-
-
Target
70016103621110.xlsm
-
Size
363KB
-
MD5
998da072875302919b2819e018eacf6f
-
SHA1
4bcb248983c0a37842cfae2bb13dcd1e6bc98c87
-
SHA256
8aa3e1396cd5802e840d87a5a0b370e28102cbe41669124981aa3d38738099a7
-
SHA512
3192effb38fe5eee4498713e4021836700067a659a869ece23ade0881fcf454c86dd5c559fa7dd1c2e5a8628a108083ac78a9a08e1b876e8f895a6bd9f5734a0
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-