Overview

overview

10

Static

static

15d677bf13...db.exe

windows7-x64

10

15d677bf13...db.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15d677bf13cdeca0cd067ed4eb39e02972ec2e5c9dfa332f5c9d49a131716ddb

  • Size

    615KB

  • Sample

    221125-l7ertadc4t

  • MD5

    a016dd97763c68e3c900d645ab357a4d

  • SHA1

    2c74ef6367ebd3835b12126b9e18e6e063ea3745

  • SHA256

    15d677bf13cdeca0cd067ed4eb39e02972ec2e5c9dfa332f5c9d49a131716ddb

  • SHA512

    19b6b5a2697621626400b9c1dea33900e435cc81a0b547f464b725652308006b68e77534ffadbec77c6631f6ced630eead7b074e5b5f80986bee3404fa412334

  • SSDEEP

    6144:zpkHOJ0qvtMWjQ/TS/zaQ54uxxoHVLtLJRvZLiLGrSPicdgnSjc4jASul6x:zpkHM0qeV2/zaIPicdgnS1A+

Score
10/10
snakekeyloggercollectionkeyloggerspywarestealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot1513074805:AAE9QtTNfInovOlDzP4PcE-Ro12KxYiz9Z4/sendMessage?chat_id=1673719962

Targets

    • Target

      15d677bf13cdeca0cd067ed4eb39e02972ec2e5c9dfa332f5c9d49a131716ddb

    • Size

      615KB

    • MD5

      a016dd97763c68e3c900d645ab357a4d

    • SHA1

      2c74ef6367ebd3835b12126b9e18e6e063ea3745

    • SHA256

      15d677bf13cdeca0cd067ed4eb39e02972ec2e5c9dfa332f5c9d49a131716ddb

    • SHA512

      19b6b5a2697621626400b9c1dea33900e435cc81a0b547f464b725652308006b68e77534ffadbec77c6631f6ced630eead7b074e5b5f80986bee3404fa412334

    • SSDEEP

      6144:zpkHOJ0qvtMWjQ/TS/zaQ54uxxoHVLtLJRvZLiLGrSPicdgnSjc4jASul6x:zpkHM0qeV2/zaIPicdgnS1A+

    Score
    10/10
    snakekeyloggercollectionkeyloggerspywarestealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks