snakekeylogger | dff468b73da99e8cf124bea61b6a154b9d3bf716301db54b6df0b7af30450c7d

General

Target

bad.docx
Size

10KB
Sample

230118-r3lmfsba97
MD5

7818486ac86d9e339c78c637319bcf0d
SHA1

03c4bbfed5eb789ab69ffe0724c4f5ae8532850f
SHA256

dff468b73da99e8cf124bea61b6a154b9d3bf716301db54b6df0b7af30450c7d
SHA512

e5a0d0679eade2e103e1b85260c883c8bbc313cb382e6eace9876aadfcd365a04a94b7a35c343ace7d5d2dcc5603df3c40b23a7024336301460e4099de61e54c
SSDEEP

192:ScIMmtP8ar5G/bfIdTOtznamWBX8ex6y3+LN:SPXt4ATOtznosM+5

Score

10^/10

Malware Config

Extracted

Rule

Microsoft Office WebSettings Relationship

C2

http://000000000000000000000000000000000000000000@3119963302/_--00_o___o00_-oo-___---0-o_o0-__________o0o-__________/jgggjjdfgjdfjghjfdggsahfhfghf.doc

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.alwethba.com
Port:
587
Username:
wissam@alwethba.com
Password:
BI21Awe7zW
Email To:
juanfragae@yandex.com

C2

https://api.telegram.org/bot5814180506:AAFpVfxl9CBszzsUeg8FTylBwiTKUc4g3lA/sendMessage?chat_id=5056270248

Targets

- Target
  
  bad.docx
- Size
  
  10KB
- MD5
  
  7818486ac86d9e339c78c637319bcf0d
- SHA1
  
  03c4bbfed5eb789ab69ffe0724c4f5ae8532850f
- SHA256
  
  dff468b73da99e8cf124bea61b6a154b9d3bf716301db54b6df0b7af30450c7d
- SHA512
  
  e5a0d0679eade2e103e1b85260c883c8bbc313cb382e6eace9876aadfcd365a04a94b7a35c343ace7d5d2dcc5603df3c40b23a7024336301460e4099de61e54c
- SSDEEP
  
  192:ScIMmtP8ar5G/bfIdTOtznamWBX8ex6y3+LN:SPXt4ATOtznosM+5
Score

10^/10

snakekeylogger collection keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Abuses OpenXML format to download file from external location
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2