snakekeylogger | 9ab4c17320817ba8a34e6e825ad56e727eb401b064e954465b283203daf0d1d1

General

Target

9ab4c17320817ba8a34e6e825ad56e727eb401b064e954465b283203daf0d1d1.exe
Size

1.2MB
Sample

250207-rfrj7avmem
MD5

176998eb8fe8c5eab508d4984131b628
SHA1

c3f166d67944dfb75ffa5fa423a12acfdcd1bd6d
SHA256

9ab4c17320817ba8a34e6e825ad56e727eb401b064e954465b283203daf0d1d1
SHA512

0bf05e33a348c5cf8497d71ca4865c09f899f627ab414a55046420ef483f8d5811c78e9966ca01bf7316d9288674dead38137283389b872fbe837a637336dcd7
SSDEEP

24576:ntb20pkaCqT5TBWgNQ7aEcrgZrZsqOvUuuq2r3cptI56A:kVg5tQ7aEccUqMvuqI4G5

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot8061096285:AAEYYo-FdY3VzqcT3L8EdN5KV_wk8MmCyiw/sendMessage?chat_id=6557702940

Targets

- Target
  
  9ab4c17320817ba8a34e6e825ad56e727eb401b064e954465b283203daf0d1d1.exe
- Size
  
  1.2MB
- MD5
  
  176998eb8fe8c5eab508d4984131b628
- SHA1
  
  c3f166d67944dfb75ffa5fa423a12acfdcd1bd6d
- SHA256
  
  9ab4c17320817ba8a34e6e825ad56e727eb401b064e954465b283203daf0d1d1
- SHA512
  
  0bf05e33a348c5cf8497d71ca4865c09f899f627ab414a55046420ef483f8d5811c78e9966ca01bf7316d9288674dead38137283389b872fbe837a637336dcd7
- SSDEEP
  
  24576:ntb20pkaCqT5TBWgNQ7aEcrgZrZsqOvUuuq2r3cptI56A:kVg5tQ7aEccUqMvuqI4G5
Score

10^/10

snakekeylogger collection discovery keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Snakekeylogger family
  snakekeylogger
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Snakekeylogger family

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2