snakekeylogger | 83a5ba65b562afb66309deae1567c919f0e08de04e2c00bb85c55102fe023b0b

General

Target
2345678098765T4323456789.exe
Size 793KB
Sample211203-lr7snabac6
SHA256 83a5ba65b562afb66309deae1567c919f0e08de04e2c00bb85c55102fe023b0b
MD5 586d514ada28e25a81dd21501de799d1
SHA1 3607a32f3d47cbde3587aeaa3132c350a1ef4afd
SHA512 9169d7de350007efe423d31200ccb9505b598855af2fbfdf51dbffede53f1301e5cb93ceef4ca4901c8d65fcf42a04851c9c648a0454a5c7860a6e6f83f4a1b7
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  2345678098765T4323456789.exe
- Size 793KB
- SHA256 83a5ba65b562afb66309deae1567c919f0e08de04e2c00bb85c55102fe023b0b
- MD5 586d514ada28e25a81dd21501de799d1
- SHA1 3607a32f3d47cbde3587aeaa3132c350a1ef4afd
- SHA512 9169d7de350007efe423d31200ccb9505b598855af2fbfdf51dbffede53f1301e5cb93ceef4ca4901c8d65fcf42a04851c9c648a0454a5c7860a6e6f83f4a1b7
- MD5 SHA1 SHA512
Score

10^/10

snakekeylogger collection keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger Payload
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Snake Keylogger

Snake Keylogger Payload

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Drops desktop.ini file(s)

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2