Overview

overview

10

Static

static

3

185968-cle...xe.exe

windows7-x64

10

185968-cle...xe.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    185968-cleanmgrseexe.exe

  • Size

    72KB

  • Sample

    230702-ps4n6sbe37

  • MD5

    b1a48b37d6eae92a63c51f1a6a26f604

  • SHA1

    f0e7411d27ba97d885ec59180fe6d66dd1f489cc

  • SHA256

    2550cd57f2bda56e2825a59a6d955020d157c7afb7cff0edf748009bd693505a

  • SHA512

    554463b204ecbf82a599cdd304ef3a2d670d4ef23d3d4f0ec89ef62bed3b2fb02912939234578a6372290424a28215d01cf6e610a9c001bfe2b131454d6ed303

  • SSDEEP

    1536:bXgZSP3VOe3U0NVpxpCcN00000000000000T0mqJO8/eRT:TgZSRpDqg

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtpm.csloxinfo.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Smr20007

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      185968-cleanmgrseexe.exe

    • Size

      72KB

    • MD5

      b1a48b37d6eae92a63c51f1a6a26f604

    • SHA1

      f0e7411d27ba97d885ec59180fe6d66dd1f489cc

    • SHA256

      2550cd57f2bda56e2825a59a6d955020d157c7afb7cff0edf748009bd693505a

    • SHA512

      554463b204ecbf82a599cdd304ef3a2d670d4ef23d3d4f0ec89ef62bed3b2fb02912939234578a6372290424a28215d01cf6e610a9c001bfe2b131454d6ed303

    • SSDEEP

      1536:bXgZSP3VOe3U0NVpxpCcN00000000000000T0mqJO8/eRT:TgZSRpDqg

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks