snakekeylogger | e47a025069729661a5b181ad7fb2bf8c173413d060b58af52a572c57e6765a76

General

Target

e47a025069729661a5b181ad7fb2bf8c173413d060b58af52a572c57e6765a76
Size

2.3MB
Sample

241008-kayyraxcqm
MD5

5d308ae37d1f8e5e7a70826d9f4c0d0f
SHA1

c165df867f57dd2de611f01589817229ab0529a2
SHA256

e47a025069729661a5b181ad7fb2bf8c173413d060b58af52a572c57e6765a76
SHA512

47d75896a681a63b4453c26ba6bad55bc92c54246954f555df084095db6c1ae28b5e25680bda8e2c84a8083b0897414c5f1c9a8dbc8d660f85a27b9c98167007
SSDEEP

49152:tXW++PT3zSLeuLV5fr2GsZcBoMjA7cAA:tG++4Bpr21msN

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
webmail.setarehatlaspars.com
Port:
587
Username:
[email protected]
Password:
Set@reh1398

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
webmail.setarehatlaspars.com
Port:
587
Username:
[email protected]
Password:
Set@reh1398
Email To:
[email protected]

Targets

- Target
  
  e47a025069729661a5b181ad7fb2bf8c173413d060b58af52a572c57e6765a76
- Size
  
  2.3MB
- MD5
  
  5d308ae37d1f8e5e7a70826d9f4c0d0f
- SHA1
  
  c165df867f57dd2de611f01589817229ab0529a2
- SHA256
  
  e47a025069729661a5b181ad7fb2bf8c173413d060b58af52a572c57e6765a76
- SHA512
  
  47d75896a681a63b4453c26ba6bad55bc92c54246954f555df084095db6c1ae28b5e25680bda8e2c84a8083b0897414c5f1c9a8dbc8d660f85a27b9c98167007
- SSDEEP
  
  49152:tXW++PT3zSLeuLV5fr2GsZcBoMjA7cAA:tG++4Bpr21msN
Score

10^/10

discovery snakekeylogger collection keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Suspicious use of NtCreateUserProcessOtherParentProcess

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2