Overview

overview

10

Static

static

3

New PO748N23.PDF.exe

windows7-x64

10

New PO748N23.PDF.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New PO748N23.PDF.exe

  • Size

    924KB

  • Sample

    230605-gmfq6aff2s

  • MD5

    a8549737d61df8a9e3df01f3d4760986

  • SHA1

    a5c9688cc73367761dc575ee28a15de62e650ab1

  • SHA256

    a753f83785176aaa5a16f73f390110dd3f804c08c52d8e90b42ed337e461da69

  • SHA512

    5e58d14dcac30e8bfb73afe16dc1fc7a689ab90abead38f89ab4fdfcd6248054d1e8d5b060c8320f8b942ba07200b6df3f7240c91ba7260997536a06a9525030

  • SSDEEP

    24576:NTbBv5rUanyfTPmHkHBP2Gu1r0hspaAcKEby9IulEN/:HBjITOHkHBP2agaAcem/

Score
10/10
snakekeyloggerstormkittycollectionkeyloggerpersistencespywarestealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5553654095:AAFY7fGm3A2NSyoJOWhzq_VfL3zRwqCo4Ow/sendMessage?chat_id=6183982484

Targets

    • Target

      New PO748N23.PDF.exe

    • Size

      924KB

    • MD5

      a8549737d61df8a9e3df01f3d4760986

    • SHA1

      a5c9688cc73367761dc575ee28a15de62e650ab1

    • SHA256

      a753f83785176aaa5a16f73f390110dd3f804c08c52d8e90b42ed337e461da69

    • SHA512

      5e58d14dcac30e8bfb73afe16dc1fc7a689ab90abead38f89ab4fdfcd6248054d1e8d5b060c8320f8b942ba07200b6df3f7240c91ba7260997536a06a9525030

    • SSDEEP

      24576:NTbBv5rUanyfTPmHkHBP2Gu1r0hspaAcKEby9IulEN/:HBjITOHkHBP2agaAcem/

    Score
    10/10
    snakekeyloggerstormkittycollectionkeyloggerpersistencespywarestealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks