snakekeylogger | 780ed56e397c2e5dcd786e85261ef0549bc29c715971933aba06c10bc7881128

General

Target

780ed56e397c2e5dcd786e85261ef0549bc29c715971933aba06c10bc7881128
Size

954KB
Sample

241116-rd357sxgmh
MD5

f21a5f9b0b58c725e506335696db8451
SHA1

8fcec3ef43597131fdbe8a97ba75356190c9cdf7
SHA256

780ed56e397c2e5dcd786e85261ef0549bc29c715971933aba06c10bc7881128
SHA512

3c9b57ceb150a944212ed80c5e743241760f955190f4792f06867d2909f75bc8627a0c94cac5f060247003af8ad30acff5367f618016c2819650fe549e36878d
SSDEEP

12288:+tb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaA7vt1aoTrWPRb/xk6A:+tb20pkaCqT5TBWgNQ7aA11+B/xk6A

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.al-subai.com
Port:
587
Username:
[email protected]
Password:
mouhannad1980$!$
Email To:
[email protected]

Targets

- Target
  
  780ed56e397c2e5dcd786e85261ef0549bc29c715971933aba06c10bc7881128
- Size
  
  954KB
- MD5
  
  f21a5f9b0b58c725e506335696db8451
- SHA1
  
  8fcec3ef43597131fdbe8a97ba75356190c9cdf7
- SHA256
  
  780ed56e397c2e5dcd786e85261ef0549bc29c715971933aba06c10bc7881128
- SHA512
  
  3c9b57ceb150a944212ed80c5e743241760f955190f4792f06867d2909f75bc8627a0c94cac5f060247003af8ad30acff5367f618016c2819650fe549e36878d
- SSDEEP
  
  12288:+tb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaA7vt1aoTrWPRb/xk6A:+tb20pkaCqT5TBWgNQ7aA11+B/xk6A
Score

10^/10

snakekeylogger collection discovery keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Snakekeylogger family
  snakekeylogger
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Snakekeylogger family

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2