Overview

overview

10

Static

static

3

d373152337...cb.exe

windows7-x64

10

d373152337...cb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5f8fc87ce2f6345fcf0e10c64be58db5a907c0acd393140387e2da2dc39f3551

  • Size

    330KB

  • Sample

    240417-rfva3sbb64

  • MD5

    85ee58811778201512b387f22eca40c5

  • SHA1

    7d66f825ffd531bd9b726b26f914cad038b3de8b

  • SHA256

    5f8fc87ce2f6345fcf0e10c64be58db5a907c0acd393140387e2da2dc39f3551

  • SHA512

    a9f0ecba9d89d02c46089eb262dd702548e3fcaaf1ae3ce65658fa73857521873a0751c7cdde39e1e267c7776c69945b21dc1a488d11511ef3f66f012c8e8745

  • SSDEEP

    6144:7wnPhoks6rCgbJBUOxLIyrNQ9rBrQYLARqljzwZWdgDT/o+wBhD7V8EF9ka:6Pyz6mY+OayroVrQY0Il3L+cV8Eh

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    instalacionestasende.com
  • Port:
    25
  • Username:
    carlos@instalacionestasende.com
  • Password:
    VzX79@6v
  • Email To:
    county@valleycountysar.org
C2

https://scratchdreams.tk

Targets

    • Target

      d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe

    • Size

      464KB

    • MD5

      1f7ac06f56077381b5097cde5c4cab87

    • SHA1

      5738220c5460de988a1b30a3a9532fd226d9d3b8

    • SHA256

      d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb

    • SHA512

      2426d1466ec06f3e67e3fdf7f01eb79cc11e46711e955e73a28d43dc5452881bfbd62d189c082d6b6224b58ab9f51a723d58688883c61ee7703cfcfeed0f2f3f

    • SSDEEP

      12288:vCXFQTAajA6n1tiGSZ4EidlIw8mfcMAAAAAAAAAAMA5AAAAAAAAAAAAAAAAAAAAP:vqFQTAajA4fo4EiIw8ccMAAAAAAAAAAd

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks