snakekeylogger | f45af8f50fd6e0ce6ccffb8aa16d0fe0b11d9db564c3d22a6789ed68ec36933f

General

Target

Siparis PO# DT-TE-160924R0 _323282-_563028621286 pdf .exe
Size

580KB
Sample

241008-k568lsyekp
MD5

07b38f706695cb1f231f67f955744eb3
SHA1

b6060e8e74d3b38443d34d30993e6cfb08552272
SHA256

f45af8f50fd6e0ce6ccffb8aa16d0fe0b11d9db564c3d22a6789ed68ec36933f
SHA512

7640e7366762e1c2acd1aedc4e9199b7009379931c89748b84196946237af4b2ea9b10843e63fff6205e212a046f06488197fe16fd28577fbb70c2d436917c26
SSDEEP

12288:ynCCg3eWoS2Ro9npcS3RkMSS2egz8l/wCqrSmE:/eWQo9OFS2egQ/4E

Score

10^/10

Malware Config

Targets

- Target
  
  Siparis PO# DT-TE-160924R0 _323282-_563028621286 pdf .exe
- Size
  
  580KB
- MD5
  
  07b38f706695cb1f231f67f955744eb3
- SHA1
  
  b6060e8e74d3b38443d34d30993e6cfb08552272
- SHA256
  
  f45af8f50fd6e0ce6ccffb8aa16d0fe0b11d9db564c3d22a6789ed68ec36933f
- SHA512
  
  7640e7366762e1c2acd1aedc4e9199b7009379931c89748b84196946237af4b2ea9b10843e63fff6205e212a046f06488197fe16fd28577fbb70c2d436917c26
- SSDEEP
  
  12288:ynCCg3eWoS2Ro9npcS3RkMSS2egz8l/wCqrSmE:/eWQo9OFS2egQ/4E
Score

10^/10

snakekeylogger collection discovery execution keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2