snakekeylogger | f32810db11d4a08094c2c1b0dfabc5d576d5a3d5e52849cd423c89225a9874c0

General

Target

a4a39c4f35d4f36d7314dfdc4858d472.exe
Size

62KB
Sample

211020-yhhtdshef7
MD5

a4a39c4f35d4f36d7314dfdc4858d472
SHA1

c62f4e32098b4bc7e3982bbe8fed3ecfa457ce49
SHA256

f32810db11d4a08094c2c1b0dfabc5d576d5a3d5e52849cd423c89225a9874c0
SHA512

d1b98c01b0514df057949f67f74a28e51d0fbda9fdee9afa2df1afb9192d77ede66f9cb99fbe210fcac64012b0cca1b678627f74db3a2767a9a7e72e696d461a

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot2011911710:AAFbAKM_5V9w0QGHqXxcRu9A7iFSTWlskIg/sendMessage?chat_id=1293496579

Targets

- Target
  
  a4a39c4f35d4f36d7314dfdc4858d472.exe
- Size
  
  62KB
- MD5
  
  a4a39c4f35d4f36d7314dfdc4858d472
- SHA1
  
  c62f4e32098b4bc7e3982bbe8fed3ecfa457ce49
- SHA256
  
  f32810db11d4a08094c2c1b0dfabc5d576d5a3d5e52849cd423c89225a9874c0
- SHA512
  
  d1b98c01b0514df057949f67f74a28e51d0fbda9fdee9afa2df1afb9192d77ede66f9cb99fbe210fcac64012b0cca1b678627f74db3a2767a9a7e72e696d461a
Score

10^/10

snakekeylogger collection evasion keylogger spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Turns off Windows Defender SpyNet reporting
  evasion
- Windows security bypass
  evasion trojan
- Nirsoft
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2