snakekeylogger | 2ca8429adde8868be7eefa5bd9787849700fc642210fe87ee3c72d6ee50c324d

General

Target
SWIFT mesaji_7582353645856740000.pdf.exe
Size 543KB
Sample230502-hxmswsaa32
SHA256 2ca8429adde8868be7eefa5bd9787849700fc642210fe87ee3c72d6ee50c324d
MD5 afe8b3a4bd40202208456b26df8b72e8
SHA1 d9f634442a476491dd11de815561275dc20a9951
SHA512 29b10e3a7b1ba561e76c466e396c047e1c8b98c0c77bd973ebd1123d0f4e4f705a4cc3f4bab377ca97f48b182bc2abec04fe21d6197172547e872be84c37a57d
SSDEEP 6144:O445np6BOBU2+tA9eWkOU5my2xuxBf49LcfRv1TJjMvJhX55iJaOdrsatkI5PwAU:sMHqoWRamy2xUBfEcJvDoeJh1skaUDi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5843567515:AAEdtJWwcJKNn64U81CKVdG-li_Ejds8raM/sendMessage?chat_id=1639214896

Targets

- Target
  SWIFT mesaji_7582353645856740000.pdf.exe
- Size 543KB
- SHA256 2ca8429adde8868be7eefa5bd9787849700fc642210fe87ee3c72d6ee50c324d
- MD5 afe8b3a4bd40202208456b26df8b72e8
- SHA1 d9f634442a476491dd11de815561275dc20a9951
- SHA512 29b10e3a7b1ba561e76c466e396c047e1c8b98c0c77bd973ebd1123d0f4e4f705a4cc3f4bab377ca97f48b182bc2abec04fe21d6197172547e872be84c37a57d
- SSDEEP 6144:O445np6BOBU2+tA9eWkOU5my2xuxBf49LcfRv1TJjMvJhX55iJaOdrsatkI5PwAU:sMHqoWRamy2xUBfEcJvDoeJh1skaUDi
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

snakekeylogger collection keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2