snakekeylogger | 6fa650ce13d6af2de198d27c1dae56d62f53bfa5f570eba1ba9bf5b26074db7c

General

Target

Documentos.exe
Size

53KB
Sample

241029-p3gbmavhpf
MD5

ecddf2614e50251fdbea5ff7f9f5a1d0
SHA1

44da5d708c1fdd66251f8cfe0e634ef40081a608
SHA256

6fa650ce13d6af2de198d27c1dae56d62f53bfa5f570eba1ba9bf5b26074db7c
SHA512

741b07b96e3ee295182799a8ac2ee91a2b389e0af0cc97b60813dfed35dc16b5daaff94ff3c69d280b33f2d8bbb15dd13d9ab5dc5ec23e89e3971914e3f6ea6c
SSDEEP

768:TOuD+Bk8PS/XCWdTKzX6C8C6aErKyrOkixg3nsdQN6weFhHvYe7dCunb/gf3YsI6:sB5YrCdHlb/gf3fIxVm60DhgrGGY0R8

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendMessage?chat_id=7546472414

Targets

- Target
  
  Documentos.exe
- Size
  
  53KB
- MD5
  
  ecddf2614e50251fdbea5ff7f9f5a1d0
- SHA1
  
  44da5d708c1fdd66251f8cfe0e634ef40081a608
- SHA256
  
  6fa650ce13d6af2de198d27c1dae56d62f53bfa5f570eba1ba9bf5b26074db7c
- SHA512
  
  741b07b96e3ee295182799a8ac2ee91a2b389e0af0cc97b60813dfed35dc16b5daaff94ff3c69d280b33f2d8bbb15dd13d9ab5dc5ec23e89e3971914e3f6ea6c
- SSDEEP
  
  768:TOuD+Bk8PS/XCWdTKzX6C8C6aErKyrOkixg3nsdQN6weFhHvYe7dCunb/gf3YsI6:sB5YrCdHlb/gf3fIxVm60DhgrGGY0R8
Score

10^/10

discovery snakekeylogger collection keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Snakekeylogger family
  snakekeylogger
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Snakekeylogger family

Suspicious use of NtCreateUserProcessOtherParentProcess

Drops startup file

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2