General

  • Target

    QUOTATION_NOVQTRA071244PDF.scr.exe

  • Size

    1.5MB

  • Sample

    241202-r47w3stngm

  • MD5

    f0c321ce3c7ea909dd26b69eb89a7573

  • SHA1

    994122e053ef5382ca32c915e508bfb731a51c62

  • SHA256

    4fc9c28322c23ab1631519326db2062e8a67a3f8245d1c57413ca2ed64ca3ace

  • SHA512

    4dd4f9533a1a35a6e59e5576e6bd0aea7cc5fee6db55806b3fc1cb7f40b7bdbc0599f2a786dd36e109db0edf01ecfab80ab2431c284a57bfc44a61592db94212

  • SSDEEP

    24576:HXz0j4KeLr+IGNlxS/oDt+312HxzXDSQWN:HXz0js6IGNlxwoB+WWQO

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      QUOTATION_NOVQTRA071244PDF.scr.exe

    • Size

      1.5MB

    • MD5

      f0c321ce3c7ea909dd26b69eb89a7573

    • SHA1

      994122e053ef5382ca32c915e508bfb731a51c62

    • SHA256

      4fc9c28322c23ab1631519326db2062e8a67a3f8245d1c57413ca2ed64ca3ace

    • SHA512

      4dd4f9533a1a35a6e59e5576e6bd0aea7cc5fee6db55806b3fc1cb7f40b7bdbc0599f2a786dd36e109db0edf01ecfab80ab2431c284a57bfc44a61592db94212

    • SSDEEP

      24576:HXz0j4KeLr+IGNlxS/oDt+312HxzXDSQWN:HXz0js6IGNlxwoB+WWQO

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Snakekeylogger family

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix

Tasks