snakekeylogger | fde3ff71fa6a80cd612d010879ce7ec36636cbc61ff23833514810a6e412ed6f

General

Target

fde3ff71fa6a80cd612d010879ce7ec36636cbc61ff23833514810a6e412ed6f
Size

342KB
Sample

231226-vcg35addbm
MD5

f82542732f7fc6ce4f9893118ff78f24
SHA1

a2ce743d069c01eb3dfebc7dddb821f713850e12
SHA256

fde3ff71fa6a80cd612d010879ce7ec36636cbc61ff23833514810a6e412ed6f
SHA512

bb484333133f91f14eeba1933dfdc47b9f42a7ba4d9a2519e107889f1f92d274e3a4b73a4d56248ff678ecd7de40c4cac642aab4a5304bda6e0c61436721e614
SSDEEP

6144:U54L5P2cXDoA/zb1tEYr3VZI9dSBKuehBrLds4kKW2x03x0mYVb154UhxiKC:A4L5P2czX/jT5ZwSBKuUBra4kKhW2JVQ

Score

10^/10

Malware Config

Targets

- Target
  
  Ramona voy 2022003.exe
- Size
  
  430KB
- MD5
  
  b56154e2714ac86af823d0eeb549d84d
- SHA1
  
  09e68a7275e1d21b5e6e28b9014790981cd0c5cd
- SHA256
  
  3a91774dd2b3db1a5670f1f974110bb09154a0b28e66fdeb8274164c6c41aa74
- SHA512
  
  0230267d992be14c8caeb469d85d5d31bff5664f50093af9b56f72311943cc9ce7fb0f8fc9ab00695768bd47bb031c258872e4acf5889e0df907822c307bc997
- SSDEEP
  
  12288:+lQjc/wxiNUzmVFLLUBd9nTPGWlQB/LVDquaLj99vXe:3eUYUzmV+LGWlQxLVHaX7/e
Score

10^/10

snakekeylogger collection keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Snake Keylogger

Snake Keylogger payload

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2