General

  • Target

    Zqpnld.exe

  • Size

    13KB

  • Sample

    230721-gjk7gacb83

  • MD5

    3c900afab0487e5ece8a8369f470f462

  • SHA1

    cc160de529d80c8a387e6729b737bc7c70234f41

  • SHA256

    9cab35781360174ec179b142782b298fb5b7b3cf60dda169e5991fb6a86bd3a4

  • SHA512

    37ad2d245acd1355ea8eedf64d4d6775e5d699bb7627549e8b7298db722d80ee2443dd1ad951e01d4c38a0c0b93b61b0dfb8cbf863fd3c123693bd92c4ed09b4

  • SSDEEP

    192:1MiUFyvhic3V44I0wWFOurXIn88aIjOUpYkC88aHRjOUpYABZfGEp8T:2lFOhd1I07FOue88a+XpBC88a9Xp8

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6362226928:AAEy_YKrGOhDs-QKpzHM8bwWaBrcjSBTM4A/sendMessage?chat_id=6373691592

Targets

    • Target

      Zqpnld.exe

    • Size

      13KB

    • MD5

      3c900afab0487e5ece8a8369f470f462

    • SHA1

      cc160de529d80c8a387e6729b737bc7c70234f41

    • SHA256

      9cab35781360174ec179b142782b298fb5b7b3cf60dda169e5991fb6a86bd3a4

    • SHA512

      37ad2d245acd1355ea8eedf64d4d6775e5d699bb7627549e8b7298db722d80ee2443dd1ad951e01d4c38a0c0b93b61b0dfb8cbf863fd3c123693bd92c4ed09b4

    • SSDEEP

      192:1MiUFyvhic3V44I0wWFOurXIn88aIjOUpYkC88aHRjOUpYABZfGEp8T:2lFOhd1I07FOue88a+XpBC88a9Xp8

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks