snakekeylogger | 1f522609abaf12c6647c56b379cdf2c9263a845a6b4c93bac7111d0c27d68159

General

Target

1f522609abaf12c6647c56b379cdf2c9263a845a6b4c93bac7111d0c27d68159.exe
Size

516KB
Sample

240524-bfle6sfg55
MD5

46dab257847ea9cfbbc77979323212c4
SHA1

8cbd33b3cf519807b2c986f7fbe3daae4175595f
SHA256

1f522609abaf12c6647c56b379cdf2c9263a845a6b4c93bac7111d0c27d68159
SHA512

ead6cefa6e39df40bdceed5dd6fb4dad3bad18d087f3d8f6d578c1e46236a32b2728e5e206b1aa7f1b6a63fa220cc87d0867be558895690000936cffd63c0dbe
SSDEEP

12288:PMYSxPCxJLpWDH0MVk6V8y8OY9xQCiGVb+r:0YSJCxpk3T09iCjVE

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.gbogboro.com
Port:
587
Username:
[email protected]
Password:
Egoamaka@123

C2

https://scratchdreams.tk

Targets

- Target
  
  1f522609abaf12c6647c56b379cdf2c9263a845a6b4c93bac7111d0c27d68159.exe
- Size
  
  516KB
- MD5
  
  46dab257847ea9cfbbc77979323212c4
- SHA1
  
  8cbd33b3cf519807b2c986f7fbe3daae4175595f
- SHA256
  
  1f522609abaf12c6647c56b379cdf2c9263a845a6b4c93bac7111d0c27d68159
- SHA512
  
  ead6cefa6e39df40bdceed5dd6fb4dad3bad18d087f3d8f6d578c1e46236a32b2728e5e206b1aa7f1b6a63fa220cc87d0867be558895690000936cffd63c0dbe
- SSDEEP
  
  12288:PMYSxPCxJLpWDH0MVk6V8y8OY9xQCiGVb+r:0YSJCxpk3T09iCjVE
Score

10^/10

snakekeylogger collection evasion execution keylogger stealer trojan
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects executables packed with or use KoiVM
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables with potential process hoocking
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2