Overview

overview

10

Static

static

dridex

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    365f4cbba678b0b44dc3ea6f52da773a178bd3fa8535918094cd435d0c3f459d

  • Size

    861KB

  • Sample

    220705-s9xtqscee7

  • MD5

    15bde2183f485dccaa7ee830edaf0886

  • SHA1

    3a8e6fbb4b2c4169bc7129a7a86568f29f035cf7

  • SHA256

    365f4cbba678b0b44dc3ea6f52da773a178bd3fa8535918094cd435d0c3f459d

  • SHA512

    f50f135b30b7419dd69a9200d29d8f379238624f23bb67f08d050863ea9123e3e5256424c0211414ad12b4ff19b87338babde3927292967d098889bc2d5402e9

Score
10/10
snakekeyloggercollectionkeyloggerspywarestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    cp5ua.hyperhost.ua
  • Port:
    587
  • Username:
    myreportlog@valete.buzz
  • Password:
    7213575aceACE@#$
  • Email To:
    myreport@valete.buzz
C2

https://api.telegram.org/bot5321688653:AAEI2yqGrOA_-sRZ3xaqutrexraSgFa0AnA/sendMessage?chat_id=5048077662

Targets

    • Target

      365f4cbba678b0b44dc3ea6f52da773a178bd3fa8535918094cd435d0c3f459d

    • Size

      861KB

    • MD5

      15bde2183f485dccaa7ee830edaf0886

    • SHA1

      3a8e6fbb4b2c4169bc7129a7a86568f29f035cf7

    • SHA256

      365f4cbba678b0b44dc3ea6f52da773a178bd3fa8535918094cd435d0c3f459d

    • SHA512

      f50f135b30b7419dd69a9200d29d8f379238624f23bb67f08d050863ea9123e3e5256424c0211414ad12b4ff19b87338babde3927292967d098889bc2d5402e9

    Score
    10/10
    snakekeyloggercollectionkeyloggerspywarestealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks