snakekeylogger | b83b2160606614373a684dc594238d895450cdb200efbd4aaa971d62491403d9

General

Target

【見積依頼】(AKFNo.20241016AA).zip
Size

486KB
Sample

241016-jxtrwazhqc
MD5

5070eb5bcade11e912c4244f9fa9b1af
SHA1

7b189b70a74f3c4ceff9498285efa85701fa39bc
SHA256

b83b2160606614373a684dc594238d895450cdb200efbd4aaa971d62491403d9
SHA512

3b38c580df9436e16479a6b4d13ec1ede0d351b314a0b7af682f6c5342a2966d22ae4b52525875a14c90b7efe9abec4e67ad4bf74915930ec4ff13ffc275accd
SSDEEP

12288:cwJ4uC3QXJhR+Ax52yC5Sk4ILCGI1Z4pa7IMD4kqZTpGjDVt9ODvd:cwJPpXkAx5Vk4IBc4xvDejDSd

Score

10^/10

Malware Config

Targets

- Target
  
  【見積依頼】(AKFNo.20241016AA).exe
- Size
  
  549KB
- MD5
  
  99cf89ca25a9990c9b21e8b3228f2280
- SHA1
  
  bbc3cd09efbe5205d0791aa09fa55927cd2a8b60
- SHA256
  
  c35a5064529bdfac908b22db56c9f874763a7f9562970828b2afd3dca5a53a05
- SHA512
  
  cab9c279637ece8a02df86414dfce7c829660402cf393c80071af4569898d39851534fb5b39370c4141da208d5726e2150c4328792bb454ae5aafebd8ffe0cd1
- SSDEEP
  
  12288:o/nRunZUtCbQXJv7ftdAQHQfo2HVfSkpa5ICD4kdAozQ:wR0CtDXJ2fo2HVfj9Fe
Score

10^/10

snakekeylogger collection discovery execution keylogger spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2