snakekeylogger | f3bd10cf894048bb27666d968b59cba2f78fd7c4148d937c946e892334bc6898

General

Target

7e590d991cf1e6437537909c294ca17948bba91dca4305998ff6bc20e9550d57.zip
Size

532KB
Sample

250210-tythlsxlan
MD5

887e54ae9716562fbe61295a9b98352f
SHA1

6d4292248873a5263b62c3f4b5a5ab0aa970b8f0
SHA256

f3bd10cf894048bb27666d968b59cba2f78fd7c4148d937c946e892334bc6898
SHA512

3299d6df62cf386864c92de6d6fb5d9d6fee036f417ead23d073cdd7d5f1d5a03512dbe22a26054f7f6bbf3272a1b937c10cb35e611095dbb07f4d138e043e01
SSDEEP

12288:tbhF4ss8/UEKp078ynQ9I2DNifE+Zl3XSAbdlK:tv4ss8/Op078n9IwYc7AbC

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot7628028410:AAEpbCbHTWOy3r7fqeLD67OvGFoUK2pQiBw/sendMessage?chat_id=7337843299

Targets

- Target
  
  7e590d991cf1e6437537909c294ca17948bba91dca4305998ff6bc20e9550d57.exe
- Size
  
  953KB
- MD5
  
  fa1a625ed0d0c6326f18bc5cffdd1082
- SHA1
  
  429ef29fa97b129fea74691bb20eebf29c47995c
- SHA256
  
  7e590d991cf1e6437537909c294ca17948bba91dca4305998ff6bc20e9550d57
- SHA512
  
  112676862516fd63f152ab38e3557e06d2e3b37b5b55b3edc65afc85a4c170d5b993fe1c915eb03616074ad630735b48f7864502322e239f74324420e151725a
- SSDEEP
  
  24576:zAHnh+eWsN3skA4RV1Hom2KXFmIa/PNa45:+h+ZkldoPK1Xa/Fx
Score

10^/10

snakekeylogger collection discovery keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Snakekeylogger family
  snakekeylogger
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Snakekeylogger family

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2