snakekeylogger | d7560e16c33ca8fbe2b4c23c1c717a634d3180b05c5260b09a1a53beb70eff53

General

Target

d7560e16c33ca8fbe2b4c23c1c717a634d3180b05c5260b09a1a53beb70eff53.exe
Size

6KB
Sample

241101-gl7s9axhpk
MD5

a71fb642174e17fae442f5cdc0fa0a37
SHA1

d1a05a09fef6a0e77a878d495e73ddf817220f66
SHA256

d7560e16c33ca8fbe2b4c23c1c717a634d3180b05c5260b09a1a53beb70eff53
SHA512

de5015d95ac18e8cb2c85f9b3448db556f8ff897d18c3823881c3679bcd1e1b7925b6cec7b1fa7caf7f653e46f59bcb58e62702489015f6e1ac465a3b46efa24
SSDEEP

48:6Go7o01xoqaUEGKWxB2tLlFyLlS7epImjVNMO+Mmz8YNh0PsrzNusVZ3gvV54tM6:bgSG+P8lce7h+p8UWUHNu4pIlrzzNt

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot8069816150:AAGUqkcMn6u9wnhjGwn59_cFD18VE7JaJgI/sendMessage?chat_id=7215551272

Targets

- Target
  
  d7560e16c33ca8fbe2b4c23c1c717a634d3180b05c5260b09a1a53beb70eff53.exe
- Size
  
  6KB
- MD5
  
  a71fb642174e17fae442f5cdc0fa0a37
- SHA1
  
  d1a05a09fef6a0e77a878d495e73ddf817220f66
- SHA256
  
  d7560e16c33ca8fbe2b4c23c1c717a634d3180b05c5260b09a1a53beb70eff53
- SHA512
  
  de5015d95ac18e8cb2c85f9b3448db556f8ff897d18c3823881c3679bcd1e1b7925b6cec7b1fa7caf7f653e46f59bcb58e62702489015f6e1ac465a3b46efa24
- SSDEEP
  
  48:6Go7o01xoqaUEGKWxB2tLlFyLlS7epImjVNMO+Mmz8YNh0PsrzNusVZ3gvV54tM6:bgSG+P8lce7h+p8UWUHNu4pIlrzzNt
Score

10^/10

discovery snakekeylogger collection keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Snakekeylogger family
  snakekeylogger
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Snakekeylogger family

Suspicious use of NtCreateUserProcessOtherParentProcess

Drops startup file

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2