Overview

overview

10

Static

static

3

8fd20cef7a...dd.exe

windows7-x64

10

8fd20cef7a...dd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    65935c52361fcf2924b32d057820124ab299e9946eb65f1b87194569127d6972

  • Size

    367KB

  • Sample

    240417-rnmafabf28

  • MD5

    640731511894d34d3b9908759836b117

  • SHA1

    4d3871093886a52d7b291a07a5f827982809c666

  • SHA256

    65935c52361fcf2924b32d057820124ab299e9946eb65f1b87194569127d6972

  • SHA512

    ef19217fcc1bedd043e95f8826eab22b89b1a5fbc1a9ea28b3a6bfcdafe9944964bbf5de43fac2aa70677b363dff07baba644dd80fc3cee592b77087cc3f7260

  • SSDEEP

    6144:ZkWqvrJNECEwjaOQinPvEWJTEa2VfNJpPbL0Zraj92cZQ++Lk96p2JvyIw:ZkBvrGVOTJ4tVfZPbLl93ZQHLk96pIyb

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    valleycountysar.org
  • Port:
    25
  • Username:
    county@valleycountysar.org
  • Password:
    iU0Ta!$K8L51
C2

http://varders.kozow.com:8081

http://aborters.duckdns.org:8081

http://anotherarmy.dns.army:8081

Targets

    • Target

      8fd20cef7ac3cda0ae24789bbc1b4a8fb6c6bc7d37c8f35d1a30a0ab5625b9dd.exe

    • Size

      482KB

    • MD5

      65849e25611a3437eb333d44ef029911

    • SHA1

      03a2ae54834b0afc9636d850dca900f27086667d

    • SHA256

      8fd20cef7ac3cda0ae24789bbc1b4a8fb6c6bc7d37c8f35d1a30a0ab5625b9dd

    • SHA512

      e3c640edfb81f183702bcc30aac5c22a854299aba684960534c7ea92e40295e945e06698b499ebd89ab5d5e545abbd0f4990868774f673952538b92680219736

    • SSDEEP

      6144:Tgwx34+E7+JyBKumvv1yE6d8J5FYyj2xlhIlsDs61IsKZyKpr40QBo24omWjmY4q:cYxEyVvXi8JrFUVKZQ0gowmXq

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks