snakekeylogger | b3d857405bc06ef7e5822e4d12f5d7128bf50ba6068553ea90db865b35a19a88

General

Target
VULKAN PVT RFQ 22122022.exe
Size 245KB
Sample221223-ep85dafg67
SHA256 b3d857405bc06ef7e5822e4d12f5d7128bf50ba6068553ea90db865b35a19a88
MD5 8001e7c2058163248ce789e2040b87b4
SHA1 e4ae2d2833a211f032dc03aeb723021f7a89a871
SHA512 fd79a916402c201af843d46f626047b174fd1b877453cebb73e0bd99c41256fb03eb5044dbfef8ae114c1bd29ee02f6deaba301209c1cb1af825a0d75902df94
SSDEEP 6144:Lkw81+T2X4FfzdDr7hJXlITJ2EddcHg3UBqaDOwddvmVt:u1+KXorBbXOWnBFXddWt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  VULKAN PVT RFQ 22122022.exe
- Size 245KB
- SHA256 b3d857405bc06ef7e5822e4d12f5d7128bf50ba6068553ea90db865b35a19a88
- MD5 8001e7c2058163248ce789e2040b87b4
- SHA1 e4ae2d2833a211f032dc03aeb723021f7a89a871
- SHA512 fd79a916402c201af843d46f626047b174fd1b877453cebb73e0bd99c41256fb03eb5044dbfef8ae114c1bd29ee02f6deaba301209c1cb1af825a0d75902df94
- SSDEEP 6144:Lkw81+T2X4FfzdDr7hJXlITJ2EddcHg3UBqaDOwddvmVt:u1+KXorBbXOWnBFXddWt
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

snakekeylogger collection keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Snake Keylogger

Snake Keylogger payload

Executes dropped EXE

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2