snakekeylogger | 5144cff448d0992466ef87b9c15cf827ef8dfebbb651422f6f0032c9317c1630

General

Target

Ref227982472 3611316041 有害物情報.Xlsx.r00
Size

536KB
Sample

240930-ky1ggs1dmh
MD5

45c91015ca63b85ecf6202993cede3ab
SHA1

3638e3dc0810c44ec1e21b6f0ce1333a86e834f3
SHA256

5144cff448d0992466ef87b9c15cf827ef8dfebbb651422f6f0032c9317c1630
SHA512

e3d3ebb684ea1b6ccfc8a3c9d6448a7916efa69186da0ddde973399f0a9ec2938cde6b22c59b16e2b6164ff3ed0a0c5049ed7c5023ba50d134f23af7d3a1bda2
SSDEEP

12288:x84eJhfz8c4nK40kOsDSTl+V8bI0UKxQ9nBW:IJZz8ck0psDSx+V8bI01mw

Score

10^/10

Malware Config

Targets

- Target
  
  Ref227982472 3611316041 有害物情報.Xlsx.exe
- Size
  
  644KB
- MD5
  
  2055e529b8767f5ebaee9afcefd16d91
- SHA1
  
  521d53678fbba3951f19dd2cfed6e4b0d5ef8914
- SHA256
  
  550aeabbe62d5a14363bac014c16acb456fd2d92ea227d5762a85a51466e3404
- SHA512
  
  e98333277ff85e147feb5efea6f0376bfbb2cd9bfa361337fdc40c5c211c626b8e7728326d40158e423b33f31eec0cdde3314dee8c19aa82042c747e6aaf01a3
- SSDEEP
  
  12288:gUxKiiSUMD8mBsdNnyVyPziLeSAkJuf3TBtN:gUxchMAfdgVUziqSAmud3
Score

10^/10

snakekeylogger collection discovery execution keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2