snakekeylogger | e43cd083a5db05eb390580af3cc8bcf29561d080e07dfbcc66c2388b8b16c454

General

Target

RFQ_Order No 43456767.js
Size

3.3MB
Sample

230213-shwscsdd9z
MD5

31402979093a6fa8d82437f4c00fdc1e
SHA1

3677af496413e8f925d10e05845a949ad71484a5
SHA256

e43cd083a5db05eb390580af3cc8bcf29561d080e07dfbcc66c2388b8b16c454
SHA512

60d81c88ce2042b91fbf9420dcbef223e91d4064203e8e6bbcebf018b67fe3574f9a437305d145dabeea8dbabec8b1d9679fc56c0cdcdc51984b0a79ff175002
SSDEEP

3072:vkbNExKp0pfpkVU5fzTyb+NuDj/yefrgd84HHM2PQOTWV/g8Ub34mOF3tgsfp9ka:vkbyHHRyV/g8U8mLsEdVARKNNKH

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
smtp.l3hharris.com
Port:
587
Username:
shaun.weeks@l3hharris.com
Password:
^JHAkmP2

C2

https://api.telegram.org/bot6151161707:AAGijmYc_-96Khu0IawsMazfJVDSOx_Z96g/sendMessage?chat_id=2006294595

Targets

- Target
  
  RFQ_Order No 43456767.js
- Size
  
  3.3MB
- MD5
  
  31402979093a6fa8d82437f4c00fdc1e
- SHA1
  
  3677af496413e8f925d10e05845a949ad71484a5
- SHA256
  
  e43cd083a5db05eb390580af3cc8bcf29561d080e07dfbcc66c2388b8b16c454
- SHA512
  
  60d81c88ce2042b91fbf9420dcbef223e91d4064203e8e6bbcebf018b67fe3574f9a437305d145dabeea8dbabec8b1d9679fc56c0cdcdc51984b0a79ff175002
- SSDEEP
  
  3072:vkbNExKp0pfpkVU5fzTyb+NuDj/yefrgd84HHM2PQOTWV/g8Ub34mOF3tgsfp9ka:vkbyHHRyV/g8U8mLsEdVARKNNKH
Score

10^/10

snakekeylogger vjw0rm collection keylogger spyware stealer trojan worm
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Vjw0rm
  Vjw0rm is a remote access trojan written in JavaScript.
  trojan worm vjw0rm
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2