General

  • Target

    INV.exe

  • Size

    674KB

  • Sample

    231128-hlxtqafg84

  • MD5

    b7d48d8454f4aa3ae1b0ed7e53559628

  • SHA1

    acbe3e258e28449feaffd199cdf005dd3bec231c

  • SHA256

    7c1725edad4a3366d166366f35d611e65705a084dc67f886b1963857f8dfa641

  • SHA512

    a8509642e21e8c28cb8aa5959a63c0fb8affbf27c8102cc381734781b959d3122991498ee9f302b4a381b4e733beeed31316ef912e83c9fc41f08d2e0f482424

  • SSDEEP

    12288:Tuid7BR6wTuHt1fKOGyfoAuuCQ1RP+OSMOcNojh31Pm+HX+Si:CipBelrGDAuuCQCGojh31e+3S

Malware Config

Targets

    • Target

      INV.exe

    • Size

      674KB

    • MD5

      b7d48d8454f4aa3ae1b0ed7e53559628

    • SHA1

      acbe3e258e28449feaffd199cdf005dd3bec231c

    • SHA256

      7c1725edad4a3366d166366f35d611e65705a084dc67f886b1963857f8dfa641

    • SHA512

      a8509642e21e8c28cb8aa5959a63c0fb8affbf27c8102cc381734781b959d3122991498ee9f302b4a381b4e733beeed31316ef912e83c9fc41f08d2e0f482424

    • SSDEEP

      12288:Tuid7BR6wTuHt1fKOGyfoAuuCQ1RP+OSMOcNojh31Pm+HX+Si:CipBelrGDAuuCQCGojh31e+3S

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks