General

  • Target

    doc 202309909910101010.exe

  • Size

    497KB

  • Sample

    231011-yzq64aaf9s

  • MD5

    4b6ba75e0680e1761dabf95c43e777cd

  • SHA1

    ac9a769d7355ea3eab0389deb2e11337cb277d48

  • SHA256

    55ddf189656363ac355a799830fa17a7097a80e850bd9434e33fe2e76aacd9e5

  • SHA512

    13e2e7edf9047bf059aed416fbce0ea954f4054b699d48f6fa41bb23482ee344b86499a9db4869b1bbd1aa6f53a1f43d048640e3a7ca812b1abf6c6b0d6cca70

  • SSDEEP

    12288:FE725SZXXjQKQX46Hp+erzNnIyDuiNdYjJAEzq9F/+LQ:BAZN6Hp+erzNnIcKJAv

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:
    smtp
  • Host:
    mail.gkas.com.tr
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Gkasteknik@2022

Targets

    • Target

      doc 202309909910101010.exe

    • Size

      497KB

    • MD5

      4b6ba75e0680e1761dabf95c43e777cd

    • SHA1

      ac9a769d7355ea3eab0389deb2e11337cb277d48

    • SHA256

      55ddf189656363ac355a799830fa17a7097a80e850bd9434e33fe2e76aacd9e5

    • SHA512

      13e2e7edf9047bf059aed416fbce0ea954f4054b699d48f6fa41bb23482ee344b86499a9db4869b1bbd1aa6f53a1f43d048640e3a7ca812b1abf6c6b0d6cca70

    • SSDEEP

      12288:FE725SZXXjQKQX46Hp+erzNnIyDuiNdYjJAEzq9F/+LQ:BAZN6Hp+erzNnIcKJAv

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks