Overview

overview

10

Static

static

3

hesaphareketi01.exe

windows7-x64

10

hesaphareketi01.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    hesaphareketi01.exe

  • Size

    601KB

  • Sample

    231202-t5yqxaea99

  • MD5

    91ac01b293586cfb99b016f67bfad863

  • SHA1

    0e35688507597afa5d1a791a9d57b6b517e101f8

  • SHA256

    5f939c927b245f51275c1dfe2b28890299d2f78cc3f4b4b63581e939705a72c5

  • SHA512

    6e000dcb60f194958ef897bd2d9e80c21d0c5143fb16c8244d240f3ce4fa7d8b0fa999f057d260f0cc9318e87d16cd4b125b75414fbc3aa5896762b4b56a2e4e

  • SSDEEP

    6144:vH5f4etd280tIozEUMIUKSwK8XdxvH7wmbB9IQv5i0THRMnXthIt5PS/LBlEN51Y:btdItzDSfMdV7ZIWinYyKQJQ4

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    mail.bhojwanindia.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    bombayoffice123

Targets

    • Target

      hesaphareketi01.exe

    • Size

      601KB

    • MD5

      91ac01b293586cfb99b016f67bfad863

    • SHA1

      0e35688507597afa5d1a791a9d57b6b517e101f8

    • SHA256

      5f939c927b245f51275c1dfe2b28890299d2f78cc3f4b4b63581e939705a72c5

    • SHA512

      6e000dcb60f194958ef897bd2d9e80c21d0c5143fb16c8244d240f3ce4fa7d8b0fa999f057d260f0cc9318e87d16cd4b125b75414fbc3aa5896762b4b56a2e4e

    • SSDEEP

      6144:vH5f4etd280tIozEUMIUKSwK8XdxvH7wmbB9IQv5i0THRMnXthIt5PS/LBlEN51Y:btdItzDSfMdV7ZIWinYyKQJQ4

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks