snakekeylogger | fb05094101868b60a53e0b1ab21495b514dd51f71fce4db73b3019aaf959ac35

General

Target

fb05094101868b60a53e0b1ab21495b514dd51f71fce4db73b3019aaf959ac35.exe
Size

761KB
Sample

240522-c6bjbshg34
MD5

2856e54f11cdc055102dcaed3585dd56
SHA1

b192fd0f524e7a94a490bc8f57d78f8e702c87cb
SHA256

fb05094101868b60a53e0b1ab21495b514dd51f71fce4db73b3019aaf959ac35
SHA512

eb2bab493418118c9c8d7955711f8f1074fcaafca01d23808960f1289d409b46e14d7632c3ebce47947621ef18e44a3b9b084275c9955f7c848ed0460a2832a8
SSDEEP

12288:SR2wgMVFB7oZFeRmn23s2fP8rsYhvYdm6piaFzYO6dkbNI:SYMZvRmFQP6s2Ydm+iaFzYOHbNI

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.gbogboro.com
Port:
587
Username:
[email protected]
Password:
Egoamaka@123

C2

https://scratchdreams.tk

Targets

- Target
  
  fb05094101868b60a53e0b1ab21495b514dd51f71fce4db73b3019aaf959ac35.exe
- Size
  
  761KB
- MD5
  
  2856e54f11cdc055102dcaed3585dd56
- SHA1
  
  b192fd0f524e7a94a490bc8f57d78f8e702c87cb
- SHA256
  
  fb05094101868b60a53e0b1ab21495b514dd51f71fce4db73b3019aaf959ac35
- SHA512
  
  eb2bab493418118c9c8d7955711f8f1074fcaafca01d23808960f1289d409b46e14d7632c3ebce47947621ef18e44a3b9b084275c9955f7c848ed0460a2832a8
- SSDEEP
  
  12288:SR2wgMVFB7oZFeRmn23s2fP8rsYhvYdm6piaFzYO6dkbNI:SYMZvRmFQP6s2Ydm+iaFzYOHbNI
Score

10^/10

snakekeylogger collection evasion execution keylogger stealer trojan
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects executables packed with or use KoiVM
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables with potential process hoocking
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2