snakekeylogger | d5a1c1d4f0dcb307b693d75f759251c84999a1f885d8e4486dbe844402a7fe84

General

Target

095b613eb266abe973e2b6f808de1961.exe
Size

1.0MB
Sample

221002-mstg4abfh4
MD5

095b613eb266abe973e2b6f808de1961
SHA1

bae2c1ac2687c7f82a0723c25e54816df513c750
SHA256

d5a1c1d4f0dcb307b693d75f759251c84999a1f885d8e4486dbe844402a7fe84
SHA512

1931ab5375de1a0fd34aa05f8af0c8ed15ed8c4cbc7fe01e2d5ea0998c9b5dbc5e08feb067883a42930eba69415efaa2da20443854ef8cd901ff6a551d6aaeb1
SSDEEP

24576:x2x6jEWJzKoImcPTtET49syHrp0Mzqn00v:46jwoI/bKUK+p0MzH0

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
cp5ua.hyperhost.ua
Port:
587
Username:
arinzelog@steuler-kch.org
Password:
7213575aceACE@#$
Email To:
arinze@steuler-kch.org

C2

https://api.telegram.org/bot5321688653:AAEI2yqGrOA_-sRZ3xaqutrexraSgFa0AnA/sendMessage?chat_id=5048077662

Targets

- Target
  
  095b613eb266abe973e2b6f808de1961.exe
- Size
  
  1.0MB
- MD5
  
  095b613eb266abe973e2b6f808de1961
- SHA1
  
  bae2c1ac2687c7f82a0723c25e54816df513c750
- SHA256
  
  d5a1c1d4f0dcb307b693d75f759251c84999a1f885d8e4486dbe844402a7fe84
- SHA512
  
  1931ab5375de1a0fd34aa05f8af0c8ed15ed8c4cbc7fe01e2d5ea0998c9b5dbc5e08feb067883a42930eba69415efaa2da20443854ef8cd901ff6a551d6aaeb1
- SSDEEP
  
  24576:x2x6jEWJzKoImcPTtET49syHrp0Mzqn00v:46jwoI/bKUK+p0MzH0
Score

10^/10

snakekeylogger collection keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2