Overview

overview

10

Static

static

CamScan031...CA.exe

windows7-x64

10

CamScan031...CA.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CamScan03102022_payment_receipt_AU9389990001RCA.exe

  • Size

    840KB

  • Sample

    221003-jptf5sfdcn

  • MD5

    b0a8c313b595faee613975f8caae0d8f

  • SHA1

    2700323d23739897ebb239b2dee27b99195163c3

  • SHA256

    d5863100cda763f0b62cb1713f18d6218336bc726ce0890136716d92dd432223

  • SHA512

    c458f3f77ba65fa45e17f9cce3f5f445f27beb8901ebe2931d4dea69e32667334a0050f9b0d7e5d8d482965882a17befc2a349b03cb801f17498ea3ed9f3b377

  • SSDEEP

    12288:QK4HTNxjAOOLPaFzwDmG0Vs5o0uaPb4aB+ypYvN3s/zpHyRhBOY4JL:o8aFHGP5zuasaBpZyRbz4JL

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5453475689:AAEPtYkTq-8THTeKrYW8b68w6CGTVgKvmpM/sendMessage?chat_id=5798274961

Targets

    • Target

      CamScan03102022_payment_receipt_AU9389990001RCA.exe

    • Size

      840KB

    • MD5

      b0a8c313b595faee613975f8caae0d8f

    • SHA1

      2700323d23739897ebb239b2dee27b99195163c3

    • SHA256

      d5863100cda763f0b62cb1713f18d6218336bc726ce0890136716d92dd432223

    • SHA512

      c458f3f77ba65fa45e17f9cce3f5f445f27beb8901ebe2931d4dea69e32667334a0050f9b0d7e5d8d482965882a17befc2a349b03cb801f17498ea3ed9f3b377

    • SSDEEP

      12288:QK4HTNxjAOOLPaFzwDmG0Vs5o0uaPb4aB+ypYvN3s/zpHyRhBOY4JL:o8aFHGP5zuasaBpZyRbz4JL

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks