Overview

overview

10

Static

static

10

1820-8-0x0...ry.exe

windows7-x64

10

1820-8-0x0...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1820-8-0x0000000000610000-0x0000000000636000-memory.dmp

  • Size

    152KB

  • Sample

    231204-k6v7qsab77

  • MD5

    0a2246e5b9bb7399da3794b814b4b7a6

  • SHA1

    83e86bf8c7509f84a00cd4903ea9218f500cc1fe

  • SHA256

    3deeca4a6e06b3de171deda4893fd69cefabf528119957b9ed8783695f55f2c9

  • SHA512

    2a71297d7fbc61a9ce8de9bd64f6036496658b923d47ab7327d313e8652be89062c16412aac8dc7db6a694ec9e066554b9d47cf25f040e9be4f7a1d34597a138

  • SSDEEP

    3072:8RorDWr82YOI1wEfeUCBFv7Vm1Tik5DgKHbSVsQHwvxTumlgbY:x2YOcwEfzRJpHbYmGb

Score
10/10
snakekeyloggercollectionkeyloggerspywarestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      1820-8-0x0000000000610000-0x0000000000636000-memory.dmp

    • Size

      152KB

    • MD5

      0a2246e5b9bb7399da3794b814b4b7a6

    • SHA1

      83e86bf8c7509f84a00cd4903ea9218f500cc1fe

    • SHA256

      3deeca4a6e06b3de171deda4893fd69cefabf528119957b9ed8783695f55f2c9

    • SHA512

      2a71297d7fbc61a9ce8de9bd64f6036496658b923d47ab7327d313e8652be89062c16412aac8dc7db6a694ec9e066554b9d47cf25f040e9be4f7a1d34597a138

    • SSDEEP

      3072:8RorDWr82YOI1wEfeUCBFv7Vm1Tik5DgKHbSVsQHwvxTumlgbY:x2YOcwEfzRJpHbYmGb

    Score
    10/10
    snakekeyloggercollectionkeyloggerspywarestealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks