snakekeylogger | 5d7e89b8db72156f0a75c96b371de14eb2ee4dc2148bc7a37e48b863e3ab50e3

General

Target

26502 teklif TR887PL783-Product Details663836.xlsx.exe
Size

6KB
Sample

241210-llsfsaxmdp
MD5

26d35e00a9c0b32cbed369bf309f096e
SHA1

1b9b2935ecf5e458fa8a797c495a6d9e2798cd86
SHA256

5d7e89b8db72156f0a75c96b371de14eb2ee4dc2148bc7a37e48b863e3ab50e3
SHA512

8f8d54bf619a5ddccd41531276fa3ce34b298eb51a742bbfc2bfe01003430d85bdbcc39262384717370abfa1d8b2dbb6c823f1c190e51e546ec0f998e81cbd06
SSDEEP

48:69o+1SIBzEM3UM7gT44vJhgyz6yw9/NOjWYbqYxVZeUBWpC7s03ACtDSl6AWFdhY:v9I6sTs1vJhkujWUnEUBWo7nmcxzNt

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot7575386281:AAH_oCv72vkYnhVFkW8Yan64MZfx3OFkaUk/sendMessage?chat_id=5302361040

Targets

- Target
  
  26502 teklif TR887PL783-Product Details663836.xlsx.exe
- Size
  
  6KB
- MD5
  
  26d35e00a9c0b32cbed369bf309f096e
- SHA1
  
  1b9b2935ecf5e458fa8a797c495a6d9e2798cd86
- SHA256
  
  5d7e89b8db72156f0a75c96b371de14eb2ee4dc2148bc7a37e48b863e3ab50e3
- SHA512
  
  8f8d54bf619a5ddccd41531276fa3ce34b298eb51a742bbfc2bfe01003430d85bdbcc39262384717370abfa1d8b2dbb6c823f1c190e51e546ec0f998e81cbd06
- SSDEEP
  
  48:69o+1SIBzEM3UM7gT44vJhgyz6yw9/NOjWYbqYxVZeUBWpC7s03ACtDSl6AWFdhY:v9I6sTs1vJhkujWUnEUBWo7nmcxzNt
Score

10^/10

discovery snakekeylogger collection keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Snakekeylogger family
  snakekeylogger
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Snakekeylogger family

Suspicious use of NtCreateUserProcessOtherParentProcess

Drops startup file

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2