General

  • Target
    d34e493e8e0dfa5e9a04ded3565e2ed4d60473148e63aeb3fca9a7f62dc90900.exe
  • Size 557KB
  • Sample240109-p87qrsceb6
  • SHA256 d34e493e8e0dfa5e9a04ded3565e2ed4d60473148e63aeb3fca9a7f62dc90900
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Targets

    • Target
      d34e493e8e0dfa5e9a04ded3565e2ed4d60473148e63aeb3fca9a7f62dc90900.exe
    • Size 557KB
    • SHA256 d34e493e8e0dfa5e9a04ded3565e2ed4d60473148e63aeb3fca9a7f62dc90900
    • MD5 SHA1 SHA512 SSDEEP
    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks