snakekeylogger | 0c00dc97caefd1b319d3c4160504d603145867085f8c88b40235f5d641737ea8

General

Target

0c00dc97caefd1b319d3c4160504d603145867085f8c88b40235f5d641737ea8
Size

609KB
Sample

240927-br1dgaxhln
MD5

576dc3a1c88651ff174545989e9d2db7
SHA1

84f42e94ecda3179dd137fa301d70679998f5b53
SHA256

0c00dc97caefd1b319d3c4160504d603145867085f8c88b40235f5d641737ea8
SHA512

e673cae2cc5d1629590d3a258dbd759d9f8e993473721856bb3afc203e1536a20a511fbea5cd9509a695bb3c8eff989cdfc042a36c4013e6370a99a01a69225f
SSDEEP

12288:oCLWkiTPCje39027UbCw1H+q8014C4vRSvUwGYXW2JpCp7Z9KFSXUXo:RkTPC3U6+q6IbGV2JEJJ

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.al-subai.com
Port:
587
Username:
[email protected]
Password:
A_Sadek1962
Email To:
[email protected]

Targets

- Target
  
  SEPT SOA OUTSTANDING_PDF.exe
- Size
  
  1007KB
- MD5
  
  4d14ec1a87ad56df26f46a04af09a582
- SHA1
  
  dcd8d83c385676560e75acf702961777ad39605b
- SHA256
  
  beb3bf20287cc5427b4a6717a68107ba6d789f43ca49d1b6b6887c102e79ae5b
- SHA512
  
  f169342b37ae4506a44aecb97115199cc2ed2ae3aabb8285fc7d5ce028c698ccc97c20e8c2bb49f51f3438b4d7de9855f4bc8f71db81d715ac45c3971a9a8424
- SSDEEP
  
  24576:pRmJkcoQricOIQxiZY1iaajn4q+8M9lFwwqkkYDday0:mJZoQrbTFZY1iain4q+B9lOl3
Score

10^/10

snakekeylogger collection discovery keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2