Overview

overview

10

Static

static

3

seznam obj...df.exe

windows7-x64

10

seznam obj...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    seznam objednávek-405598204.pdf.exe

  • Size

    516KB

  • Sample

    240524-f7q7ysfb41

  • MD5

    4ed3b0d6ac9550e9164ca7e9c2ddebaf

  • SHA1

    91d57eb738d0e4147a6fcd6b277315b67a7fcf20

  • SHA256

    b3440eca83ef91708410f9ff328b605c50a8ca8ba0a9428703e9d5fe6dd9eefd

  • SHA512

    9e2e6464f359a39ee0410454d0581a2f087d8dd826da287371cd61d12cdaf5beb84935623b47ad36f7e49138e3881439c2dd86bf2dd8fc9fcf2a0d90f6840b9d

  • SSDEEP

    12288:3j3vFsUQIvCZKrlpLzFq2NBGuErD9ZMshdub1VtumXD:T3vFh0Krn7DyUs6b16ID

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    mail.gbogboro.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Lovelove@123
C2

https://scratchdreams.tk

Targets

    • Target

      seznam objednávek-405598204.pdf.exe

    • Size

      516KB

    • MD5

      4ed3b0d6ac9550e9164ca7e9c2ddebaf

    • SHA1

      91d57eb738d0e4147a6fcd6b277315b67a7fcf20

    • SHA256

      b3440eca83ef91708410f9ff328b605c50a8ca8ba0a9428703e9d5fe6dd9eefd

    • SHA512

      9e2e6464f359a39ee0410454d0581a2f087d8dd826da287371cd61d12cdaf5beb84935623b47ad36f7e49138e3881439c2dd86bf2dd8fc9fcf2a0d90f6840b9d

    • SSDEEP

      12288:3j3vFsUQIvCZKrlpLzFq2NBGuErD9ZMshdub1VtumXD:T3vFh0Krn7DyUs6b16ID

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks