snakekeylogger | 9b772d731ae3513c192bac1315ca57a5806573e5fbd4d1ee97c36a26e19cb700

General

Target
9b772d731ae3513c192bac1315ca57a5806573e5fbd4d1ee97c36a26e19cb700.unknown
Size 25KB
Sample241025-p2bprazblb
SHA256 9b772d731ae3513c192bac1315ca57a5806573e5fbd4d1ee97c36a26e19cb700
MD5 c152a37a8e547114e9d1c07e361e6ace
SHA1 f26c09689d479305a4cb5c3acc1912eae397db39
SHA512 0d4f0514ecc2be6dd27a9028799f588136d446f6a90c121b700b63cb24b4ceda2e73aa355d160b7b93746f707d0a681b9bc2c170b0e1ce493aad0915607b61ec
SSDEEP 384:j+22XYubxeq4ADiS4NWawioYMnPUEsT8qv4pRLUcj/f72IQ0Rc87/DMDHnlgGoqt:jWXvoADPMvw5nc74ar4/jv28OHnlg9+P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
gator3220.hostgator.com
Port
587
Username
[email protected]
Password
G!!HFpD6EwDq*nF

Targets

- Target
  9b772d731ae3513c192bac1315ca57a5806573e5fbd4d1ee97c36a26e19cb700.unknown
- Size 25KB
- SHA256 9b772d731ae3513c192bac1315ca57a5806573e5fbd4d1ee97c36a26e19cb700
- MD5 c152a37a8e547114e9d1c07e361e6ace
- SHA1 f26c09689d479305a4cb5c3acc1912eae397db39
- SHA512 0d4f0514ecc2be6dd27a9028799f588136d446f6a90c121b700b63cb24b4ceda2e73aa355d160b7b93746f707d0a681b9bc2c170b0e1ce493aad0915607b61ec
- SSDEEP 384:j+22XYubxeq4ADiS4NWawioYMnPUEsT8qv4pRLUcj/f72IQ0Rc87/DMDHnlgGoqt:jWXvoADPMvw5nc74ar4/jv28OHnlg9+P
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral1 behavioral2
- Target
  QUOTATION_OCTQTRA071244PDF.scr
- Size 331KB
- SHA256 1964205c3ba627bb974acd0338212de06cf442c95b7b1bd17647a2879407b3d8
- MD5 56a0eb16583c87251084dee7f8e358d2
- SHA1 ef8f0c3826a8bfd08a670a68711146d2106886b8
- SHA512 789d4c056d7ef46da0f8614175179351221feee357af49e772ccfa4ad4180e58f1cec33d01e75eb9b0db6801ccbe80d8522f0bebda2e936e7e484944b970e30e
- SSDEEP 768:RbLdbQe2VzEjss2yXg1ILcn0sspAgpq80Lyg1uMN0+dzsRU+eEyl:R5Q7E/pqrLy0uyz+fyl
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

snakekeylogger collection keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Snakekeylogger family
  snakekeylogger
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Snakekeylogger family

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4