snakekeylogger | 7b2fcffe77e320517c511f5a3700d8545712475aeb4dc04088537fa8456fec77

General

Target

7b2fcffe77e320517c511f5a3700d8545712475aeb4dc04088537fa8456fec77N
Size

934KB
Sample

241006-ceq5pszbqk
MD5

d515411b9a3c0d9fb13b9c6a928a7fd0
SHA1

f940a7302ac76567c15efb1a15d789b42224aac3
SHA256

7b2fcffe77e320517c511f5a3700d8545712475aeb4dc04088537fa8456fec77
SHA512

447a5ab235672a2d067e5792260aa5b978720f8d67ac80bd875e74d7032cb496e3b0463f3c3870bd87d975cddf7f750df35a9ea7aa8aa65f1bd1590d3305c9d6
SSDEEP

24576:ffmMv6Ckr7Mny5QLyf5/wh0ZMx6he17l2N:f3v+7/5QLyho+ZK6he17+

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.teilecar.com
Port:
587
Username:
[email protected]
Password:
Manta924porsche=911
Email To:
[email protected]

Targets

- Target
  
  7b2fcffe77e320517c511f5a3700d8545712475aeb4dc04088537fa8456fec77N
- Size
  
  934KB
- MD5
  
  d515411b9a3c0d9fb13b9c6a928a7fd0
- SHA1
  
  f940a7302ac76567c15efb1a15d789b42224aac3
- SHA256
  
  7b2fcffe77e320517c511f5a3700d8545712475aeb4dc04088537fa8456fec77
- SHA512
  
  447a5ab235672a2d067e5792260aa5b978720f8d67ac80bd875e74d7032cb496e3b0463f3c3870bd87d975cddf7f750df35a9ea7aa8aa65f1bd1590d3305c9d6
- SSDEEP
  
  24576:ffmMv6Ckr7Mny5QLyf5/wh0ZMx6he17l2N:f3v+7/5QLyho+ZK6he17+
Score

10^/10

snakekeylogger collection discovery keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2