snakekeylogger | a29e9b8e67c16a0c46bed63e400297cb520b0084d1a2cccd76fcc4201caae734

General

Target
a29e9b8e67c16a0c46bed63e400297cb520b0084d1a2cccd76fcc4201caae734.exe
Size 842KB
Sample250905-ryptbaykt4
SHA256 a29e9b8e67c16a0c46bed63e400297cb520b0084d1a2cccd76fcc4201caae734
MD5 f661d5030f28025f9f13441627876509
SHA1 328cbec9c725b44a2702d9a392fd69efed581005
SHA512 b95ed215ed05ee768323bbcde2675e507fe90b03a8cfc191f1c093176df9dbfaeb4ced90c8d81b68b8d6c48fbe3e3bc6fa9fe16c3274647be03c949916e6cd5b
SSDEEP 24576:1ILrZnXqyllglglglvRsA9+RDh5xiOyE+OiO2dX1LT:1e6FA/ryud2zLT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.nirmanpower.org
Port
587
Username
[email protected]
Password
Nirman@7127

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
mail.nirmanpower.org
Port
587
Username
[email protected]
Password
Nirman@7127
Email to
[email protected]

Targets

- Target
  a29e9b8e67c16a0c46bed63e400297cb520b0084d1a2cccd76fcc4201caae734.exe
- Size 842KB
- SHA256 a29e9b8e67c16a0c46bed63e400297cb520b0084d1a2cccd76fcc4201caae734
- MD5 f661d5030f28025f9f13441627876509
- SHA1 328cbec9c725b44a2702d9a392fd69efed581005
- SHA512 b95ed215ed05ee768323bbcde2675e507fe90b03a8cfc191f1c093176df9dbfaeb4ced90c8d81b68b8d6c48fbe3e3bc6fa9fe16c3274647be03c949916e6cd5b
- SSDEEP 24576:1ILrZnXqyllglglglvRsA9+RDh5xiOyE+OiO2dX1LT:1e6FA/ryud2zLT
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

collection discovery snakekeylogger keylogger stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Snakekeylogger family
  snakekeylogger
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Snake Keylogger

Snake Keylogger payload

Snakekeylogger family

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2