snakekeylogger | efdbe10cecbc88e6d1cf4371494bfbb0b81abfe4810d618fd437255e41dc2f3e

General

Target

efdbe10cecbc88e6d1cf4371494bfbb0b81abfe4810d618fd437255e41dc2f3e.exe
Size

975KB
Sample

241024-cxd8vszgme
MD5

97ee6841e06ab3f460b258f43d4a65ad
SHA1

6e1eee9085c38abdbf4838f82c1c560ed1e4467a
SHA256

efdbe10cecbc88e6d1cf4371494bfbb0b81abfe4810d618fd437255e41dc2f3e
SHA512

b0da19409b05460fc1c2461c1b400b56aa045584bbebc504f703c66cd394ecdc67a623b3394e3f8e9c16ac5222228207129768de214e455f5d95e0882fbbf687
SSDEEP

24576:A7GWB7+31+uvrsHIuj6Zo/ba9HKdNcJp+54Bq2mH6:mTocu9HocJkqH/

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.grupoarlosa.net
Port:
587
Username:
[email protected]
Password:
Arlosa1
Email To:
[email protected]

Targets

- Target
  
  efdbe10cecbc88e6d1cf4371494bfbb0b81abfe4810d618fd437255e41dc2f3e.exe
- Size
  
  975KB
- MD5
  
  97ee6841e06ab3f460b258f43d4a65ad
- SHA1
  
  6e1eee9085c38abdbf4838f82c1c560ed1e4467a
- SHA256
  
  efdbe10cecbc88e6d1cf4371494bfbb0b81abfe4810d618fd437255e41dc2f3e
- SHA512
  
  b0da19409b05460fc1c2461c1b400b56aa045584bbebc504f703c66cd394ecdc67a623b3394e3f8e9c16ac5222228207129768de214e455f5d95e0882fbbf687
- SSDEEP
  
  24576:A7GWB7+31+uvrsHIuj6Zo/ba9HKdNcJp+54Bq2mH6:mTocu9HocJkqH/
Score

10^/10

discovery snakekeylogger collection keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Suspicious use of NtCreateUserProcessOtherParentProcess

Drops startup file

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2