Overview

overview

10

Static

static

3

KSA-PDA_17122023.exe

windows7-x64

10

KSA-PDA_17122023.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KSA-PDA_17122023.exe

  • Size

    723KB

  • Sample

    231218-g1fy3shbhr

  • MD5

    3dff19e34ed9a7f7ccc7d64000884890

  • SHA1

    70260264fa675af06d320ed289e8513d4a0d3344

  • SHA256

    fccac8700366b9cf48eafc5c012a1616534d26fc6501d4014e56a0619d5d0db4

  • SHA512

    85f740d25c5a5089e1f8e284766800a781c3b371499dda3c525d09613d6a92c08c6b1ae93297c70c8525ef03a7954c1e286443c2162cb0a04af685e68f4059ae

  • SSDEEP

    6144:152RKZ/DhvC7+a0Yu4GLtf0uGizuwhZfaq0Re1K9XoiNZKspgeJNwkKTZlrzV0UX:152R7XCGiiZqoeoNNgI36vrB0gGwJjl

Score
10/10
snakekeyloggercollectionkeyloggerspywarestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      KSA-PDA_17122023.exe

    • Size

      723KB

    • MD5

      3dff19e34ed9a7f7ccc7d64000884890

    • SHA1

      70260264fa675af06d320ed289e8513d4a0d3344

    • SHA256

      fccac8700366b9cf48eafc5c012a1616534d26fc6501d4014e56a0619d5d0db4

    • SHA512

      85f740d25c5a5089e1f8e284766800a781c3b371499dda3c525d09613d6a92c08c6b1ae93297c70c8525ef03a7954c1e286443c2162cb0a04af685e68f4059ae

    • SSDEEP

      6144:152RKZ/DhvC7+a0Yu4GLtf0uGizuwhZfaq0Re1K9XoiNZKspgeJNwkKTZlrzV0UX:152R7XCGiiZqoeoNNgI36vrB0gGwJjl

    Score
    10/10
    snakekeyloggercollectionkeyloggerspywarestealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks