Overview

overview

10

Static

static

BOQ Draw...df.exe

windows7_x64

10

BOQ Draw...df.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    BOQ Drawings.pdf.7z
  • Size 6KB
  • Sample211027-taflvafec5
  • SHA256 8283821fc5e59a90e5d45882478a08fa86d98ef7cf1f2055c84ffffb62dc65ff
  • MD5 SHA1 SHA512
Score
10/10
snakekeyloggeragilenetcollectionkeyloggerspywarestealer

Malware Config

Extracted

Family

  • snakekeylogger

C2

  • https://api.telegram.org/bot2011911710:AAFbAKM_5V9w0QGHqXxcRu9A7iFSTWlskIg/sendMessage?chat_id=1293496579

Targets

    • Target
      BOQ Drawings.pdf.exe
    • Size 18KB
    • SHA256 6852eb3651d23650c65945cea17d1a43d82f1035354a2a9832c8e7f70950ffc8
    • MD5 SHA1 SHA512
    Score
    10/10
    snakekeyloggercollectionkeyloggerspywarestealeragilenet

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Downloads MZ/PE file

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks