snakekeylogger | 3a0bbe57a6c8253d8e46b0f2ea18e4ee47cd2f12f0211e34c3031fb359f7570f

General

Target

3a0bbe57a6c8253d8e46b0f2ea18e4ee47cd2f12f0211e34c3031fb359f7570f.exe
Size

539KB
Sample

240910-hpj22asepg
MD5

fb36d36dc1599c31de5f311727014cce
SHA1

9133e2b8931d193ca7391af677f06217ba1e3666
SHA256

3a0bbe57a6c8253d8e46b0f2ea18e4ee47cd2f12f0211e34c3031fb359f7570f
SHA512

6cdfaafa5f28cfbc3b597beb4fb928693780cb4fc74f59917408f5c9cf3c75989303e9e3dc179c7a34fd4fe991c7743f8d2b9532abf9414239f42ce74f23aaa9
SSDEEP

12288:6u3q6ytY8X2pbcQ61YoxDJyylIaYmlQVfS3Xszbt1IPra9i72lD:rPyt3v1VxDJYh1VaHKxqPrakED

Score

10^/10

Malware Config

Targets

- Target
  
  3a0bbe57a6c8253d8e46b0f2ea18e4ee47cd2f12f0211e34c3031fb359f7570f.exe
- Size
  
  539KB
- MD5
  
  fb36d36dc1599c31de5f311727014cce
- SHA1
  
  9133e2b8931d193ca7391af677f06217ba1e3666
- SHA256
  
  3a0bbe57a6c8253d8e46b0f2ea18e4ee47cd2f12f0211e34c3031fb359f7570f
- SHA512
  
  6cdfaafa5f28cfbc3b597beb4fb928693780cb4fc74f59917408f5c9cf3c75989303e9e3dc179c7a34fd4fe991c7743f8d2b9532abf9414239f42ce74f23aaa9
- SSDEEP
  
  12288:6u3q6ytY8X2pbcQ61YoxDJyylIaYmlQVfS3Xszbt1IPra9i72lD:rPyt3v1VxDJYh1VaHKxqPrakED
Score

10^/10

snakekeylogger collection credential_access discovery execution keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2