Overview

overview

10

Static

static

3

sipariş.exe

windows7-x64

10

sipariş.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    =XUTF-8XQXsipari=C5=9F=2Er00X=

  • Size

    518KB

  • Sample

    241111-ng6tqaygpg

  • MD5

    f66f9aa6ebec2988050097b94352c64a

  • SHA1

    d8c0ea130f28708ab1b43db718b029494b3c7921

  • SHA256

    2cab02c0147b28c922fbec54c4bc897647822618ad37fea4ea9f15722c15397b

  • SHA512

    c9352964e75abbc7db7c45d05d1016fffa4114b88158721481d0fb063b7cade46addfda6e9098a1326f1bb8bb9608bbbe39a8e69d7af44d2766d3671de1b33e9

  • SSDEEP

    12288:lc/AC7cCIhVtLsDqOXGLHsoy3jFOThU3QPGYVNjGlD5ZfQRdf6Wm7xv7:u/ehVtoDqrbl+jFOTu0GSNqjZfQP6Hxj

Score
10/10
snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    50.31.176.103
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    HW=f09RQ-BL1

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     ftp
  • Host:
    ftp://50.31.176.103/
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    HW=f09RQ-BL1

Targets

    • Target

      sipariş.pif

    • Size

      718KB

    • MD5

      dc1317eb10b6a85ccc468e5c3c4871af

    • SHA1

      21805ffb7deccb435317abc3f7bbc79c7447a644

    • SHA256

      396d5ef9ac6eeb363625a3969b1c428389e29e06b70698c2addec8456b8a1843

    • SHA512

      933debebd6c85be54a1ad253b9792e1458a05cddb53d6f03b517ec822896f82d7e313bf8dce8b480590118161abaee6fa99d11512f6ac4e1b897a76628dfce39

    • SSDEEP

      12288:ZaMv62XP/91H3UB7yiJ2tzAlld0JpZuJKl5w:ZaMvZEtyiCAlSZuol

    Score
    10/10
    snakekeyloggercollectiondiscoveryexecutionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Snakekeylogger family

      snakekeylogger

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks