General

  • Target

    4.lha

  • Size

    78KB

  • Sample

    241115-rarb8synan

  • MD5

    8ff9c5a6c68cfff4d269681d0297fa50

  • SHA1

    d26394e2b539382b9e90d03649266b0fddfb609d

  • SHA256

    2275d7af7032d6f742787cb55bdb4a24c0441b9ef251467ff5a88c028882e9f7

  • SHA512

    cbfd772a5a246902fc0ee6f62d50823bdc192c6b463c1463ba57b6f356d805165f52471887aa819beee4c0cc2b0c89412fd7d1dc70987a3566661fb0c62fe83c

  • SSDEEP

    1536:2JKiEaWT6XgpDuff/hwoUSdpFXs0RhDE4AlnbyhB3+kz/sW:AW+X0Dk/hwHSdjXVRhIflbyHVz/X

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:
    smtp
  • Host:
    gator3220.hostgator.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    sqlv#))OxYLxAXyhMyi

Targets

    • Target

      QUOTATION_NOVQTRA071244PDF.scr

    • Size

      183KB

    • MD5

      c0ff92d3f8d44d4b144d62a25203fb54

    • SHA1

      7c629df73009ae5e11173087b8b899efb0bcc1e7

    • SHA256

      1714590ed838170aed9ae4fcf702db472b860f5e4efaf25056aae4c219ce9921

    • SHA512

      ef7829d88818df1e768242d12d25dd49b2d9afb15bab3fbced8e8b30de1530aa74842a3e37729391f4f068944d2b98eef3cf561e686c78e535cc6559e54f4221

    • SSDEEP

      3072:JZpuHH5banPQKWBTVOc8pdOo6NPzKkwGLu0AsxLzBuO:JDunNsPeBsc8dOo6NPuk5ixsFzBu

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Snakekeylogger family

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks