Overview

overview

10

Static

static

3

QUOTATION_...DF.scr

windows7-x64

10

QUOTATION_...DF.scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4.lha

  • Size

    501KB

  • Sample

    241118-re9z5sxqaw

  • MD5

    ecea71a5cb36f2a7fa88ca11fdea46fe

  • SHA1

    5a07d0301bcc1b02b4a0dc596b353b52b15cc2c5

  • SHA256

    36cdc6df8de12cc11fb6918cd4096d03e3d7b344eb0ad2d6f16bd2c0bcafbbda

  • SHA512

    e8a142b00e3cc5ad5c0c006b69acc64573229608dca4abce6902295f5095d08fb10b8a94be8714a16233859392e5e8a161a393c73e581e4bd5486141d1b9c459

  • SSDEEP

    12288:Y1BwtEvJQYDaB4VtNmSzeYpavxMfoyds2RYJcMHMtin:Y1VtNXqMavxMfoyu2mJTHMon

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    gator3220.hostgator.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    G!!HFpD@N*]*nF

Targets

    • Target

      QUOTATION_NOVQTRA071244PDF.scr

    • Size

      1.4MB

    • MD5

      9c6de69b3f4bd16dc76a37fd8a50aea4

    • SHA1

      a5c6f87a637a6e5ffd073dc90a3cbfa0591160c1

    • SHA256

      137ad88b1c43f6aa6f01b9b8a7b15027387d501dbe7af463a7b639f5abf3f116

    • SHA512

      255dbc20c850d91eaccbe338b99ef1e144af703e6bc88c70f8d8d0f6dd2089cbbc6ddb2f8b4dccd6770c75bc21176ae41566eb995d58645ae0a86d42ef1d3841

    • SSDEEP

      12288:Yx093lfiCZNsgg/iUZ0vXTWyzopB2QrJ30Bme47vAn+TbzeB:YIiFzj+vXhzop5rJ3gmYSe

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Snakekeylogger family

      snakekeylogger

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks