snakekeylogger | d298c16cc5f3bc92be81294b9d7b4b23d1be22742956b824dac7dc109dde7e35

General

Target
price request & delivery status_24655754.exe
Size 572KB
Sample230418-nnvp2ach2z
SHA256 d298c16cc5f3bc92be81294b9d7b4b23d1be22742956b824dac7dc109dde7e35
MD5 7752516159e2731b381e8b977daea808
SHA1 4706143e9084f415e0b91dbdd2e4d9e5bd7ccea2
SHA512 c090daa7fea8e669085b25e4cca790948a7233b1f1859aac0c8fb35ac1599566cd62cffdc42eea8f141ec13cbee31d1b2163460f4c0ccbc8653cb014e1883a68
SSDEEP 12288:6PG7TzTblzzXny/ObdY1STy6ichPhSBoV2yjRKithoczSGGhzJ:6QTzTJX4OpE6ichJ2oV2yU4hobv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6166695280:AAFYAmHtNxka4VVDE564YnB1MkmT68AnzXY/sendMessage?chat_id=5981442240

Targets

- Target
  price request & delivery status_24655754.exe
- Size 572KB
- SHA256 d298c16cc5f3bc92be81294b9d7b4b23d1be22742956b824dac7dc109dde7e35
- MD5 7752516159e2731b381e8b977daea808
- SHA1 4706143e9084f415e0b91dbdd2e4d9e5bd7ccea2
- SHA512 c090daa7fea8e669085b25e4cca790948a7233b1f1859aac0c8fb35ac1599566cd62cffdc42eea8f141ec13cbee31d1b2163460f4c0ccbc8653cb014e1883a68
- SSDEEP 12288:6PG7TzTblzzXny/ObdY1STy6ichPhSBoV2yjRKithoczSGGhzJ:6QTzTJX4OpE6ichJ2oV2yU4hobv
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

snakekeylogger collection keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2