Overview

overview

10

Static

static

5

Invoice 43...c..exe

windows7-x64

10

Invoice 43...c..exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa40797ad336bfd33d3918b3bc2af71a7bd3e93d445030d992eb59917aae250c

  • Size

    537KB

  • Sample

    240906-x5pd1stfpl

  • MD5

    3758102db3c262e3d7b7652b1594a1ae

  • SHA1

    00b2baf318e41362454f5bb39ed4c2c206bcfd4b

  • SHA256

    fa40797ad336bfd33d3918b3bc2af71a7bd3e93d445030d992eb59917aae250c

  • SHA512

    b09601a30d280a5c6165dc70b9b0b33e4e5a9de0cea3adb876ce2cccaf9c0bf7beddd2119ba9c0b269b3fd3e3c0fbc78bc2711bb35e974125e4117776fdb8358

  • SSDEEP

    12288:ehICvZqhH4xGcIKho8cGZOLmBE6tlNus6AhI7m2v:sIQLGcPhwGZmmBE6XNLMd

Score
10/10
snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    smtp.skagenships.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    XAqEAz@4

Targets

    • Target

      Invoice 43822 from America's Custom Brokers, Inc..exe

    • Size

      960KB

    • MD5

      19db2b3ae98177fe961f6c37484a19e0

    • SHA1

      300c59f3701777706be62295ea6b0fb2572578d6

    • SHA256

      fff78538dca574199007cc6f4ab1898d10661c36a6df8694e3cb68f17dd24f17

    • SHA512

      f46f0f7c9fbd17b571f772638a31602baf2b0738ca0071e648f6d7d658c0012649d2fefa5eaa25f7a98e19acd0692d729937ba6fdc3acf6d075c36bdfc4f81df

    • SSDEEP

      24576:9AHnh+eWsN3skA4RV1Hom2KXMmHa5Fc895:ch+ZkldoPK8Ya5Ft

    Score
    10/10
    snakekeyloggerdiscoverykeyloggerstealercollectioncredential_access

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks