snakekeylogger | 12289f31e91714adb706cab61a7d13e75efd1b6e95268098e86b6f43ed485739

General

Target

12289f31e91714adb706cab61a7d13e75efd1b6e95268098e86b6f43ed485739.exe
Size

654KB
Sample

240910-bep2za1dld
MD5

320588ad824390773445333799942a6d
SHA1

821a8297ac44e93ac049f3748da22f05c952ac32
SHA256

12289f31e91714adb706cab61a7d13e75efd1b6e95268098e86b6f43ed485739
SHA512

244089da427b2d6a82340252d3ea68c9c2a17e843037394d9573c3e7aece1adeeb970e9539f825ea9eda42a58ba70c9e6aca0ec428a43c009aa195dd9fb9ffd4
SSDEEP

12288:77fth0hhyShRkW9h3Twk53QONi+ovQMavm2yrRv1dXiX5Gvy:DEyqRkyTF5++oIMKKb8G

Score

10^/10

Malware Config

Targets

- Target
  
  12289f31e91714adb706cab61a7d13e75efd1b6e95268098e86b6f43ed485739.exe
- Size
  
  654KB
- MD5
  
  320588ad824390773445333799942a6d
- SHA1
  
  821a8297ac44e93ac049f3748da22f05c952ac32
- SHA256
  
  12289f31e91714adb706cab61a7d13e75efd1b6e95268098e86b6f43ed485739
- SHA512
  
  244089da427b2d6a82340252d3ea68c9c2a17e843037394d9573c3e7aece1adeeb970e9539f825ea9eda42a58ba70c9e6aca0ec428a43c009aa195dd9fb9ffd4
- SSDEEP
  
  12288:77fth0hhyShRkW9h3Twk53QONi+ovQMavm2yrRv1dXiX5Gvy:DEyqRkyTF5++oIMKKb8G
Score

10^/10

snakekeylogger collection credential_access discovery execution keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2