General

  • Target

    452ab69e222c880f6637f943819cfa466df71dac0f1dcfa31e6ba3744a832748.exe

  • Size

    830KB

  • Sample

    240508-p1g55sfg27

  • MD5

    533ffbc1a40a9d13ddb15f7ad5415da5

  • SHA1

    b5b7399ef2bfca57a70fec8ef6ee62843542e587

  • SHA256

    452ab69e222c880f6637f943819cfa466df71dac0f1dcfa31e6ba3744a832748

  • SHA512

    6456487bb20f568295d0d226c93b35b4486e49721c50ba59c93cc6657c9afb6099e78ea9565998321190cf05bf236ef48f34913690b96bdfea52c8711b310bb1

  • SSDEEP

    24576:M0220C8uECnmUShKoWQST75l0ewP+nAvfaWdAyQPCt98dlT:hAvfTQPd9

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:
    smtp
  • Host:
    mail.gbogboro.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Lovelove@123
C2

https://scratchdreams.tk

Targets

    • Target

      452ab69e222c880f6637f943819cfa466df71dac0f1dcfa31e6ba3744a832748.exe

    • Size

      830KB

    • MD5

      533ffbc1a40a9d13ddb15f7ad5415da5

    • SHA1

      b5b7399ef2bfca57a70fec8ef6ee62843542e587

    • SHA256

      452ab69e222c880f6637f943819cfa466df71dac0f1dcfa31e6ba3744a832748

    • SHA512

      6456487bb20f568295d0d226c93b35b4486e49721c50ba59c93cc6657c9afb6099e78ea9565998321190cf05bf236ef48f34913690b96bdfea52c8711b310bb1

    • SSDEEP

      24576:M0220C8uECnmUShKoWQST75l0ewP+nAvfaWdAyQPCt98dlT:hAvfTQPd9

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Drops startup file

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks