General

  • Target

    916acca260cdbdacc5327366a7b087a73241fef37d734a97749baf5c526ea059_JC.exe

  • Size

    545KB

  • Sample

    230806-w4nknada8z

  • MD5

    9f0377d0a3c6e3fd416b0f43eeff149f

  • SHA1

    059f5eb2a8c6def6080da84da4876b3b7f43ff13

  • SHA256

    916acca260cdbdacc5327366a7b087a73241fef37d734a97749baf5c526ea059

  • SHA512

    44a9858bbc34d5d71caf879c301b2dcb10a89496901aa4b8e826348e45857898861e9fd16ce3a6bb5ee58340a2a196e3d880c2eddd98926c7ac088c114a3cb6d

  • SSDEEP

    12288:B+1xYQvjO9KEw6bgsGbqChoI/kn1s7P1k73ywqEg8/F3x:B+1fOEEdD/Ch58n1/CCg8b

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      916acca260cdbdacc5327366a7b087a73241fef37d734a97749baf5c526ea059_JC.exe

    • Size

      545KB

    • MD5

      9f0377d0a3c6e3fd416b0f43eeff149f

    • SHA1

      059f5eb2a8c6def6080da84da4876b3b7f43ff13

    • SHA256

      916acca260cdbdacc5327366a7b087a73241fef37d734a97749baf5c526ea059

    • SHA512

      44a9858bbc34d5d71caf879c301b2dcb10a89496901aa4b8e826348e45857898861e9fd16ce3a6bb5ee58340a2a196e3d880c2eddd98926c7ac088c114a3cb6d

    • SSDEEP

      12288:B+1xYQvjO9KEw6bgsGbqChoI/kn1s7P1k73ywqEg8/F3x:B+1fOEEdD/Ch58n1/CCg8b

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks