Overview

overview

10

Static

static

3

Voyage Orders.exe

windows7-x64

10

Voyage Orders.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Voyage Orders.exe

  • Size

    738KB

  • Sample

    230610-l3x3lafc91

  • MD5

    64230ba43ee32c6ef45ef52e5e9827c8

  • SHA1

    0a8ae546c3fcfb2165101b945a8ff67c906778d4

  • SHA256

    ec8db8d90582b2c57d0dcf5670ed679c9008b435d0bd2cadca037c84d25df57a

  • SHA512

    f1dade9fe791a85197af24dff90426eb101f1637a6f08c593804102c585bd8c2e606765f91b6ff9903c80248c3dc0d0961719cf28c611a52b9eeeb2bbc562cfe

  • SSDEEP

    12288:5ZyvbhaDnLMzIL2q+RTdOL8+F8UjXfnfR+T2cH4mAGRn+zEEgNgiNFyc05+isz+2:cOyqGUL8+CUjXvfsqcH4mAGx+RgNBycX

Score
10/10
snakekeyloggercollectionkeyloggerspywarestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    argona.ro
  • Port:
    26
  • Username:
    dan.grama@argona.ro
  • Password:
    Argona12!@
  • Email To:
    trainee@valleycountysar.org

Targets

    • Target

      Voyage Orders.exe

    • Size

      738KB

    • MD5

      64230ba43ee32c6ef45ef52e5e9827c8

    • SHA1

      0a8ae546c3fcfb2165101b945a8ff67c906778d4

    • SHA256

      ec8db8d90582b2c57d0dcf5670ed679c9008b435d0bd2cadca037c84d25df57a

    • SHA512

      f1dade9fe791a85197af24dff90426eb101f1637a6f08c593804102c585bd8c2e606765f91b6ff9903c80248c3dc0d0961719cf28c611a52b9eeeb2bbc562cfe

    • SSDEEP

      12288:5ZyvbhaDnLMzIL2q+RTdOL8+F8UjXfnfR+T2cH4mAGRn+zEEgNgiNFyc05+isz+2:cOyqGUL8+CUjXvfsqcH4mAGx+RgNBycX

    Score
    10/10
    snakekeyloggercollectionkeyloggerspywarestealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks