snakekeylogger | db3ff97d0dc9d07beddcf60b3062e3d6f325e4abf134b0908b5299784b92d49f

General

Target

32e3f433b732245bcd8a27d204a770fc82d70010f3cb1549dc91f04d24849941.zip
Size

191KB
Sample

220521-jsq57aebhr
MD5

a0c70f227e1c25ab8096453b3fce4786
SHA1

a8fcea0598a00be4e96a91dbed078887015c7f61
SHA256

db3ff97d0dc9d07beddcf60b3062e3d6f325e4abf134b0908b5299784b92d49f
SHA512

5cec8df65041dac334a79e1188a17ed37c0a9d0a0080db6df5c9ee345fe70d870980385dcc67b6c2040f2ed6953966f6a84040eb75fa0cb27d7f9f29b3f8f8fe

Score

10^/10

Malware Config

Targets

- Target
  
  32e3f433b732245bcd8a27d204a770fc82d70010f3cb1549dc91f04d24849941.exe
- Size
  
  229KB
- MD5
  
  773aeb8b7d2c978f5e6827e3156a5115
- SHA1
  
  5cf948bc30bca89a8b32ed38c5c723cca13fa196
- SHA256
  
  32e3f433b732245bcd8a27d204a770fc82d70010f3cb1549dc91f04d24849941
- SHA512
  
  5b76cc3802f7809bbb389048358bb0374273406492445c75abe301342ba9b7833f613073e7c5eda4e1d249b947822d6ffdba10735685ff0825055cd2b4a8b376
Score

10^/10

snakekeylogger collection keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger Payload
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Snake Keylogger

Snake Keylogger Payload

Executes dropped EXE

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2