snakekeylogger | 9f7dcc426c18599399aa689622aeca0426916296aeda29b12cd9d25a6ed9a987

General

Target

9f7dcc426c18599399aa689622aeca0426916296aeda29b12cd9d25a6ed9a987
Size

490KB
Sample

250328-dqvgyatjy8
MD5

8ed1b5b74744816ce6a72e5b5c64a8c2
SHA1

2cbb389598e9adc724d5c56922974fcca902392c
SHA256

9f7dcc426c18599399aa689622aeca0426916296aeda29b12cd9d25a6ed9a987
SHA512

8e8ecb1d2ccd23e9d061be976aff6f24e16c32b0cbf1d84dee671a63db11927ef725de40fb2ba19899fcb3c8b86a1ea3b75416142aa8a362be165b427eeafa3c
SSDEEP

12288:sfgzE5nEeNw5IyK9/g1URQR8mUx205JIwFtMqISjTBR7SzWeS:lzaTNw5eg1pR1oA0iqIM7SnS

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot7939905545:AAGZ8bMeWRWU5UEZdgj90fd6BDk9K4EMabA/sendMessage?chat_id=7000018009

Targets

- Target
  
  Quote 09052022-008.exe
- Size
  
  978KB
- MD5
  
  1312de280df9f1a993e4c3d93764010b
- SHA1
  
  8021cc971121660193bf049ad4e20db1421b73f2
- SHA256
  
  f406a0fd055028ed41cfbc96b9bffb575e14272b26cb5091c7a16f35d15c821b
- SHA512
  
  3e3830e22b1d34beef07557ce859bbeda607e12a5c334749f12428f6a894e4f3a124b6a63b720c72baa5bb21f486b937657fed6f5e2d0d59e5922f7dbc279871
- SSDEEP
  
  24576:8u6J33O0c+JY5UZ+XC0kGso6FaVMn6ULbyZvNWY:mu0c++OCvkGs9FaVMnLbyZAY
Score

10^/10

snakekeylogger collection discovery keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Snakekeylogger family
  snakekeylogger
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Snakekeylogger family

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2