General

  • Target

    61460220761a54e3263ca427e082c7542bd531ed5c2aae397757be3cb313bb74.exe

  • Size

    526KB

  • Sample

    241009-hz38naweqh

  • MD5

    acdb58c5abad0535de184d32c04c75a5

  • SHA1

    7323524e5f90cbc698ce33f2bdd00e62c3694943

  • SHA256

    61460220761a54e3263ca427e082c7542bd531ed5c2aae397757be3cb313bb74

  • SHA512

    68835987cce5e15186f9aec6469a026399893856b800c8d47f497e9fb5c86d5b64432e9f45e8dffb5dcb0152ac7cbf5980386a7c94967381d80d6ced4e6461b6

  • SSDEEP

    12288:rQf0SXm2tHVpXss+FcNzQqIgQbM9zab12ord:rQ9Xsxi1IfKmvx

Malware Config

Targets

    • Target

      61460220761a54e3263ca427e082c7542bd531ed5c2aae397757be3cb313bb74.exe

    • Size

      526KB

    • MD5

      acdb58c5abad0535de184d32c04c75a5

    • SHA1

      7323524e5f90cbc698ce33f2bdd00e62c3694943

    • SHA256

      61460220761a54e3263ca427e082c7542bd531ed5c2aae397757be3cb313bb74

    • SHA512

      68835987cce5e15186f9aec6469a026399893856b800c8d47f497e9fb5c86d5b64432e9f45e8dffb5dcb0152ac7cbf5980386a7c94967381d80d6ced4e6461b6

    • SSDEEP

      12288:rQf0SXm2tHVpXss+FcNzQqIgQbM9zab12ord:rQ9Xsxi1IfKmvx

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks