snakekeylogger | 8c366bddcc19d07924b953259274f43f30c9a70f726c70420f8a01e07a209734

General

Target

תשלום בסוויפט 110468 3.11.2023.scr.exe
Size

1.1MB
Sample

231103-trxxfsee9z
MD5

cf89a03d499a9da3518a943bdaaf3f9a
SHA1

f6e1db56f0a6a88a787920a56acbb2406b5fca2b
SHA256

8c366bddcc19d07924b953259274f43f30c9a70f726c70420f8a01e07a209734
SHA512

4c61ab6c7014a868a7f1568074c018e469a2a4af6428a7e40cb4370d07b7c083a4b710d0c5b2c6c7c8ac5224e8301705643b599c3159f521dd97540df61f84f4
SSDEEP

24576:UfjHsVx69As4hkB/YAuseX7KvO1YAuJMi+sPV3GykDfMNVzCOgKIQtKoColK5dwL:CjHZ9AsQpAuserKvpAuJMi+sPV3GykDM

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
resultsurex.com
Port:
587
Username:
[email protected]
Password:
d()&nzU1tC3+

Protocol: ftp
Host:
ftp://ftp.resultsurex.com/
Port:
21
Username:
[email protected]
Password:
[XH~0fB9c]@*

C2

https://api.telegram.org/bot6783929306:AAFJU35OkwjDMHKdR2FUDQELnw67_grsAts/sendMessage?chat_id=5986156290

Targets

- Target
  
  תשלום בסוויפט 110468 3.11.2023.scr.exe
- Size
  
  1.1MB
- MD5
  
  cf89a03d499a9da3518a943bdaaf3f9a
- SHA1
  
  f6e1db56f0a6a88a787920a56acbb2406b5fca2b
- SHA256
  
  8c366bddcc19d07924b953259274f43f30c9a70f726c70420f8a01e07a209734
- SHA512
  
  4c61ab6c7014a868a7f1568074c018e469a2a4af6428a7e40cb4370d07b7c083a4b710d0c5b2c6c7c8ac5224e8301705643b599c3159f521dd97540df61f84f4
- SSDEEP
  
  24576:UfjHsVx69As4hkB/YAuseX7KvO1YAuJMi+sPV3GykDfMNVzCOgKIQtKoColK5dwL:CjHZ9AsQpAuserKvpAuJMi+sPV3GykDM
Score

10^/10

snakekeylogger collection keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2