snakekeylogger | c708cc67a42e04e58e49c8d3cc2cbf2808e82cd075fb1dee85a9d7ce772673ea

General

Target

c708cc67a42e04e58e49c8d3cc2cbf2808e82cd075fb1dee85a9d7ce772673ea.exe
Size

798KB
Sample

240807-ckrcna1gma
MD5

d0098216d48b3116a8e2366caa3623c3
SHA1

2ae0779e97d065572f005a3d9c78fa298785a766
SHA256

c708cc67a42e04e58e49c8d3cc2cbf2808e82cd075fb1dee85a9d7ce772673ea
SHA512

b9b452437c4844a63858374b69f0636c0d618834e314fe9151260ba31e4ca2a766144720657828f00e373bba5f0a10a809074bf0bba3ed1b4a25bbcdb8e6a72f
SSDEEP

24576:z1c1teTiYi7tP/2Bbe4GJTDxmbQcCiL/VAW:yrCM5P/MxGJTDEbwiLtD

Score

10^/10

Malware Config

Targets

- Target
  
  c708cc67a42e04e58e49c8d3cc2cbf2808e82cd075fb1dee85a9d7ce772673ea.exe
- Size
  
  798KB
- MD5
  
  d0098216d48b3116a8e2366caa3623c3
- SHA1
  
  2ae0779e97d065572f005a3d9c78fa298785a766
- SHA256
  
  c708cc67a42e04e58e49c8d3cc2cbf2808e82cd075fb1dee85a9d7ce772673ea
- SHA512
  
  b9b452437c4844a63858374b69f0636c0d618834e314fe9151260ba31e4ca2a766144720657828f00e373bba5f0a10a809074bf0bba3ed1b4a25bbcdb8e6a72f
- SSDEEP
  
  24576:z1c1teTiYi7tP/2Bbe4GJTDxmbQcCiL/VAW:yrCM5P/MxGJTDEbwiLtD
Score

10^/10

snakekeylogger collection credential_access discovery execution keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2