Overview

overview

10

Static

static

3

728aacf77f...67.exe

windows7-x64

1

728aacf77f...67.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    728aacf77f919b92f4bc04b4dec7898345dc57f0080fe09f16290ce424671767.exe

  • Size

    287KB

  • Sample

    240727-ll2z8atgld

  • MD5

    d747188c998cbd80a03250d578236e29

  • SHA1

    cb2aff28e4271a441d0e55dce58783fb224902ab

  • SHA256

    728aacf77f919b92f4bc04b4dec7898345dc57f0080fe09f16290ce424671767

  • SHA512

    569acb73c8d233d08bc5d803e19cecf9995850d85c46812a490c23360d376bf4bccc036310832b57e589bc286aa3226b035ec248ec76b35d2c10ed4074f4e205

  • SSDEEP

    3072:hOlcp8wD7b6DhT4PrzD8VHCydY+pkzDqVHzYdKwDdomYcQGqKfjlOj0EdZdzdAHX:ICpDGFT4QndzYdKwDdomXfjc0EH2

Score
10/10
snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      728aacf77f919b92f4bc04b4dec7898345dc57f0080fe09f16290ce424671767.exe

    • Size

      287KB

    • MD5

      d747188c998cbd80a03250d578236e29

    • SHA1

      cb2aff28e4271a441d0e55dce58783fb224902ab

    • SHA256

      728aacf77f919b92f4bc04b4dec7898345dc57f0080fe09f16290ce424671767

    • SHA512

      569acb73c8d233d08bc5d803e19cecf9995850d85c46812a490c23360d376bf4bccc036310832b57e589bc286aa3226b035ec248ec76b35d2c10ed4074f4e205

    • SSDEEP

      3072:hOlcp8wD7b6DhT4PrzD8VHCydY+pkzDqVHzYdKwDdomYcQGqKfjlOj0EdZdzdAHX:ICpDGFT4QndzYdKwDdomXfjc0EH2

    Score
    10/10
    snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks