snakekeylogger | 5f55b5beeb4271d51ae0ee7539dee244bece4e8846e5bb68002816052b3e3870

General

Target

36A4CE95-45C2-4059-8975-9F3BA8325548.pdf.z
Size

583KB
Sample

241022-rje1kayfle
MD5

26dfc0875f5f0243beb3942bd5f62f7e
SHA1

06872aea006af18e3f3cff17fef3886969d321a3
SHA256

5f55b5beeb4271d51ae0ee7539dee244bece4e8846e5bb68002816052b3e3870
SHA512

a4eda1a37860cc7b2d3b1cd9097a62f5e720621455d48295831c24a56fa86e5b15d1b5cca1807af110fcede3b7b19d855364b2bb1e43819aa411913f7212d2db
SSDEEP

12288:EIC+j2Ak0bzil1W6lWxkORBY23aoB0j4dYCBfJTMuJ4lZsT/PuFWxYA+c+E:zxFk0fil/IxkOd3a4dDijZsDPu8xac/

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot7754092182:AAFhYG1ixwJ3gbkMI8P9ofyeJ8nQ3W5NoAU/sendMessage?chat_id=6008123474

Targets

- Target
  
  36A4CE95-45C2-4059-8975-9F3BA8325548.pdf.exe
- Size
  
  922KB
- MD5
  
  27e278b3f081e2912b69eafe4e67d551
- SHA1
  
  a003df37c0d214dba9bbc8b041852354a43e00d7
- SHA256
  
  c9c4df8ccf2d7149cf5c6ad5e630e5b8385ba3e8ec6d3cbf31d362abb57671b5
- SHA512
  
  b912042baa589c99ee1f424b6c8e199ef9fe69f5678b0e40aed0e9820cce6d06364cfd51248a30a373d5c49198390d8e98cdd7e389ff8672d618f3b77ae60924
- SSDEEP
  
  12288:dLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QWmqzbe7cJN+yt1AyPD2BRax2S:hfmMv6Ckr7Mny5QWmkC4JozkyB4x2S
Score

10^/10

snakekeylogger collection discovery keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Drops startup file

Executes dropped EXE

Loads dropped DLL

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2