snakekeylogger | c8361efdf2c26f872b481fc64b7a24cc9a203952916a75d5dafb34b4b4445377

General

Target

c8361efdf2c26f872b481fc64b7a24cc9a203952916a75d5dafb34b4b4445377
Size

591KB
Sample

241004-pcfbmsxdna
MD5

78add14da172a1478a2837558ee0077c
SHA1

c15ce10eafd3912ff09b7075fa6b54e8a1075a18
SHA256

c8361efdf2c26f872b481fc64b7a24cc9a203952916a75d5dafb34b4b4445377
SHA512

eddab30e0a8a9b8c92c44b20d6101bc1f8b8436fbbd67dfaa06cdf7dc87093f52cbf2f9f0588f9eb79d460a2999ffecf37e50cd41123f8683676e9910c71650c
SSDEEP

12288:ChiRSO9tYT0sLt5Nv1t7SoxnlKQtpLS4A6UnVyZgdNsNcamM:7BtI0Mh1h5xIWpLW6UVt2NcamM

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.al-subai.com
Port:
587
Username:
[email protected]
Password:
A_Sadek1962
Email To:
[email protected]

Targets

- Target
  
  Soa.exe
- Size
  
  940KB
- MD5
  
  32c473da08e7d07464f3632f81792436
- SHA1
  
  690988213510ae6cb1b03306c51e408670e8c4c4
- SHA256
  
  7c8fefbe9b0778ca074d9c110d8c9bd875bdb08eb9fdc697c395cf6aea5581c4
- SHA512
  
  acf354ec39a72d5142a668cfc451e2fc80668a6193d324991b90fe811cee19f7a8bad015fa9a99ce708d2d402810660e6d5759b3bc2d74f44379c86f832ed310
- SSDEEP
  
  24576:ffmMv6Ckr7Mny5QLcFv7lpvrt6FNJiMSn:f3v+7/5QLKvppvJ2M/n
Score

10^/10

snakekeylogger collection discovery keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2