snakekeylogger | b35f4051c45fc83d79730c63e559b29635c37ff739d2ff42b1eecea69ae1495d

General

Target

03102024_0338_02102024_movimiento_INGDIRECT.rar
Size

759KB
Sample

241003-d62wyswfmb
MD5

88df1a52636d795c63dc864daa61a2f7
SHA1

9aa9e43d3cd9cdea417c28f3d98258dafd38e8fa
SHA256

b35f4051c45fc83d79730c63e559b29635c37ff739d2ff42b1eecea69ae1495d
SHA512

9fd12f2893e5e4c18b9a9ca07ebe064c4949d87750dc25002fa63161735f89fe113c8295f18adf3c0e1e2f6cdffa2e112f45795d15342f0169270364bfabd8b7
SSDEEP

12288:8UPVfPEAk0bBilG1do54i9i7fvfTVLMMGyINegdgYOC+YeP8ntqR5xO2I6o2EdOB:fXk0FilGDo54i96oqVgmrC+zP8tqDzIu

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot7952998151:AAFh98iY7kaOlHAR0qftD3ZcqGbQm0TXbBY/sendMessage?chat_id=5692813672

Targets

- Target
  
  movimiento_INGDIRECT.exe
- Size
  
  1.1MB
- MD5
  
  ccc0959be83b0b131aca1fcba4c11933
- SHA1
  
  5ab753380fd42d721dd7bd86ed2749e2a6971141
- SHA256
  
  234b29254c74b56a48500049daf1d42f149906c1d29bf0ebde2100de8dc956cd
- SHA512
  
  b11cda02f884f26b36639fbad9ae7421ac073ceb0cd9acade1e91af9b2e0651b55c2bf373a6c8b437e2ac4835b7f6cc18eacfc5a863ea6e7fcd404b7dfca113d
- SSDEEP
  
  24576:ffmMv6Ckr7Mny5QLUr07BMqUscDLuYocEFq+kK:f3v+7/5QLUQ7BYArmPK
Score

10^/10

snakekeylogger collection discovery keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Drops startup file

Executes dropped EXE

Loads dropped DLL

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2