Overview

overview

10

Static

static

3

nuevo pedido.exe

windows7-x64

10

nuevo pedido.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    nuevo pedido.r00

  • Size

    518KB

  • Sample

    241111-lkwrtawqbz

  • MD5

    4e48b1b9b8a8608e7d759a1638a4b7ab

  • SHA1

    0ad3be9dbdf538028a71b3bc62b4af7dfd433874

  • SHA256

    5f69af27f78dbefe180e5a2e73d4544a4eeffacf078f57e2b26e481333b24f5d

  • SHA512

    49134836a7d2f27442f7672afbd6271377b3960951fc138f0b292351d18afadeb83ce714cdcf3da0a5fe873c32e304f492de401c38ef73687bf56056ed5a16c4

  • SSDEEP

    12288:/c/AC7cCIhVtLsDqOXGLHsoy3jFOThU3QPGYVNjGlD5ZfQRdf6Wm7xvQ:U/ehVtoDqrbl+jFOTu0GSNqjZfQP6Hxo

Score
10/10
snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    50.31.176.103
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    HW=f09RQ-BL1

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     ftp
  • Host:
    ftp://50.31.176.103/
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    HW=f09RQ-BL1

Targets

    • Target

      nuevo pedido.pif

    • Size

      718KB

    • MD5

      dc1317eb10b6a85ccc468e5c3c4871af

    • SHA1

      21805ffb7deccb435317abc3f7bbc79c7447a644

    • SHA256

      396d5ef9ac6eeb363625a3969b1c428389e29e06b70698c2addec8456b8a1843

    • SHA512

      933debebd6c85be54a1ad253b9792e1458a05cddb53d6f03b517ec822896f82d7e313bf8dce8b480590118161abaee6fa99d11512f6ac4e1b897a76628dfce39

    • SSDEEP

      12288:ZaMv62XP/91H3UB7yiJ2tzAlld0JpZuJKl5w:ZaMvZEtyiCAlSZuol

    Score
    10/10
    snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Snakekeylogger family

      snakekeylogger

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks