General

  • Target

    822e06191849b35415693155a46edff39c41db14f3dce949120456c1b7b55892.exe

  • Size

    618KB

  • Sample

    241002-bsczkatfpa

  • MD5

    43523528dffe8705862304986c04665d

  • SHA1

    d94e95afbbd1ae578ceff278ade301ebd7dfbdf6

  • SHA256

    822e06191849b35415693155a46edff39c41db14f3dce949120456c1b7b55892

  • SHA512

    b6ad05059763d326c4e0e799ff1324ac141c1a5f4e443b2ca07de643dc80daec5860cb40f1c400b3e9ada6bd319aebc805b4dbda1924aad31b0014e2440e79d8

  • SSDEEP

    12288:Wa27wCe1S4QKMVkdg0uUG3DgIdGztFeQDHVxE:p2MCeL7eKG8IdOF/7E

Malware Config

Targets

    • Target

      822e06191849b35415693155a46edff39c41db14f3dce949120456c1b7b55892.exe

    • Size

      618KB

    • MD5

      43523528dffe8705862304986c04665d

    • SHA1

      d94e95afbbd1ae578ceff278ade301ebd7dfbdf6

    • SHA256

      822e06191849b35415693155a46edff39c41db14f3dce949120456c1b7b55892

    • SHA512

      b6ad05059763d326c4e0e799ff1324ac141c1a5f4e443b2ca07de643dc80daec5860cb40f1c400b3e9ada6bd319aebc805b4dbda1924aad31b0014e2440e79d8

    • SSDEEP

      12288:Wa27wCe1S4QKMVkdg0uUG3DgIdGztFeQDHVxE:p2MCeL7eKG8IdOF/7E

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks