General

  • Target

    d8df8ae0a2b685d4a9e0e2bc5c624c2b8b9be74d8a0ce6d00ba982e9077398e4.exe

  • Size

    497KB

  • Sample

    241016-gd9ymsvgne

  • MD5

    50e9a50199c9bfa7aa74c1181901c401

  • SHA1

    34044f843bd8d705e5165d137d3286edd7c75cfe

  • SHA256

    d8df8ae0a2b685d4a9e0e2bc5c624c2b8b9be74d8a0ce6d00ba982e9077398e4

  • SHA512

    25175cf756febc6e8427b9140a1ca3793cebbea1a9611bc790f34136fa0ffadc31480faca76ea4010a50ee0014c62787d7514ac4db9612311e7675d82afcbb93

  • SSDEEP

    12288:wQUSPFoVcNNMRoFt2JY0KlkWM9iPcPo3LSQXDUEFxj:wOdNKRA4YDdPc2SAZX

Malware Config

Targets

    • Target

      d8df8ae0a2b685d4a9e0e2bc5c624c2b8b9be74d8a0ce6d00ba982e9077398e4.exe

    • Size

      497KB

    • MD5

      50e9a50199c9bfa7aa74c1181901c401

    • SHA1

      34044f843bd8d705e5165d137d3286edd7c75cfe

    • SHA256

      d8df8ae0a2b685d4a9e0e2bc5c624c2b8b9be74d8a0ce6d00ba982e9077398e4

    • SHA512

      25175cf756febc6e8427b9140a1ca3793cebbea1a9611bc790f34136fa0ffadc31480faca76ea4010a50ee0014c62787d7514ac4db9612311e7675d82afcbb93

    • SSDEEP

      12288:wQUSPFoVcNNMRoFt2JY0KlkWM9iPcPo3LSQXDUEFxj:wOdNKRA4YDdPc2SAZX

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks