General

  • Size

    740KB

  • Sample

    220923-g8clmaddb5

  • MD5

    d94e6d2a099ee896488b28452eb0d5f0

  • SHA1

    19db83582d45a71d83a162ed2fc90b3af5422051

  • SHA256

    b1e886e95c76a7a0dccc3d15bc383bc4e87ec8b8d37e83d77c12b139d57e6d9f

  • SHA512

    866460f614a17aadade0e5fd01ad3a8fa9eee0f0c578bc5fdfe7452020201df06626ac6b0fbe6f99fc8d5b6a6882088dea0379c960f8a969185d39d5ca40859d

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp

Host: us2.smtp.mailhostbox.com

Port: 587

Username: feritkalafatoglu@frem-tr.com

Password: LYSV$*b4

Email To: feritkalafatoglu@frem-tr.com

Targets

    • Target

      tmp

    • Size

      740KB

    • MD5

      d94e6d2a099ee896488b28452eb0d5f0

    • SHA1

      19db83582d45a71d83a162ed2fc90b3af5422051

    • SHA256

      b1e886e95c76a7a0dccc3d15bc383bc4e87ec8b8d37e83d77c12b139d57e6d9f

    • SHA512

      866460f614a17aadade0e5fd01ad3a8fa9eee0f0c578bc5fdfe7452020201df06626ac6b0fbe6f99fc8d5b6a6882088dea0379c960f8a969185d39d5ca40859d

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

      Execution

        Exfiltration

          Impact

            Initial Access

              Lateral Movement

                Persistence

                Privilege Escalation