Overview

overview

10

Static

static

scan_invoi...22.exe

windows7-x64

10

scan_invoi...22.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    scan_invoice08022022.exe

  • Size

    987KB

  • Sample

    220923-hs5g5sddf5

  • MD5

    74b81196baf04c9ca3c20b05c209535a

  • SHA1

    3472af8b7fba4eed2e22d1603ffcdd2c1913f2d5

  • SHA256

    d305aa9539f2074ac6b663b385cd9e3905dd3f9b1755cf8d9d3b724c3831a16e

  • SHA512

    81ede5795f9411f9acc35084c947b06e54d95eec7bd217080c8cd3d82622f3f6e065a630f6115e7c9f82f170bf3755da9812d26acaa9d97d410b082eb0c5ac7a

  • SSDEEP

    24576:IhLuyyepsA0mIBGHmujp66s7l/mpfUp60L:sLuyye2AGQGuYZwps0

Score
10/10
snakekeyloggercollectionevasionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5633295549:AAH9lzzrf8Ep6i2K5UISY92DSUSu9k_w37Y/sendMessage?chat_id=5671926480

Targets

    • Target

      scan_invoice08022022.exe

    • Size

      987KB

    • MD5

      74b81196baf04c9ca3c20b05c209535a

    • SHA1

      3472af8b7fba4eed2e22d1603ffcdd2c1913f2d5

    • SHA256

      d305aa9539f2074ac6b663b385cd9e3905dd3f9b1755cf8d9d3b724c3831a16e

    • SHA512

      81ede5795f9411f9acc35084c947b06e54d95eec7bd217080c8cd3d82622f3f6e065a630f6115e7c9f82f170bf3755da9812d26acaa9d97d410b082eb0c5ac7a

    • SSDEEP

      24576:IhLuyyepsA0mIBGHmujp66s7l/mpfUp60L:sLuyye2AGQGuYZwps0

    Score
    10/10
    snakekeyloggercollectionevasionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

5
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks