General
-
Target
Documents for your perusal.js
-
Size
290KB
-
Sample
220616-gqwa1shad7
-
MD5
aea6c9f795a0d2d9b3c04607264089db
-
SHA1
12a0f096bb384a03a948d81ac40bf8acc5a51549
-
SHA256
b4c23e9ce7984024ba96876bdb1b68b13b41ca70f77efab5e157c8ce130edd39
-
SHA512
83201ec2c617e24edaccd3c9cde0486187ca0880bbea8fba95974ef386275d52c33564571d3f231e6ea750be33bc60c12fac2f0a9927f613f9a09e4224625338
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.theroyalreception.com - Port:
587 - Username:
[email protected] - Password:
computer@147 - Email To:
[email protected]
https://api.telegram.org/bot5463029534:AAGQ1do_-JYjhQ1yKKugHhT9LGbrpA7291Y/sendMessage?chat_id=1604450602
Targets
-
-
Target
Documents for your perusal.js
-
Size
290KB
-
MD5
aea6c9f795a0d2d9b3c04607264089db
-
SHA1
12a0f096bb384a03a948d81ac40bf8acc5a51549
-
SHA256
b4c23e9ce7984024ba96876bdb1b68b13b41ca70f77efab5e157c8ce130edd39
-
SHA512
83201ec2c617e24edaccd3c9cde0486187ca0880bbea8fba95974ef386275d52c33564571d3f231e6ea750be33bc60c12fac2f0a9927f613f9a09e4224625338
Score10/10-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload
-
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-