snakekeylogger | d7c2fe9485b6c29fb527f162ecfdd6724db6fd1abca5ce08582e2860e998b3be

General

Target

SOA..exe
Size

283KB
Sample

230328-gzbyqshc68
MD5

2fb4a6541352bc6ddef8ac5751572cca
SHA1

0b256d3a9439252035f92280d359be04c176fc0a
SHA256

d7c2fe9485b6c29fb527f162ecfdd6724db6fd1abca5ce08582e2860e998b3be
SHA512

936486109ef67313a1d2c03a360ba430c979bab6f9235ca847d7788c67e88639baad471468491f749cc8370e00f1c04151578eebbc8b33a41727c9f9c3ba4782
SSDEEP

6144:/Ya6dRGROV5Ap2Jv7FVnXGgerSZLaPPGQbS8pZEpLjimuL1XTJ66fC2nlkQ2G:/YDRG4bjjXG7rSeP+8pZEVWmW1DJ665V

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6112875567:AAELAi1dztc_XKpDFEg1a1IG01250o2gxXs/sendMessage?chat_id=5687933537

Targets

- Target
  
  SOA..exe
- Size
  
  283KB
- MD5
  
  2fb4a6541352bc6ddef8ac5751572cca
- SHA1
  
  0b256d3a9439252035f92280d359be04c176fc0a
- SHA256
  
  d7c2fe9485b6c29fb527f162ecfdd6724db6fd1abca5ce08582e2860e998b3be
- SHA512
  
  936486109ef67313a1d2c03a360ba430c979bab6f9235ca847d7788c67e88639baad471468491f749cc8370e00f1c04151578eebbc8b33a41727c9f9c3ba4782
- SSDEEP
  
  6144:/Ya6dRGROV5Ap2Jv7FVnXGgerSZLaPPGQbS8pZEpLjimuL1XTJ66fC2nlkQ2G:/YDRG4bjjXG7rSeP+8pZEVWmW1DJ665V
Score

10^/10

snakekeylogger collection keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Executes dropped EXE

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2