snakekeylogger | 35a9d0a41ffc3fcc67dc174be1905bd83037f6877ea342b215559b9cbd8fd0de

General

Target
e-dekont.pdf.exe
Size 1.6MB
Sample251014-h9rydazry5
SHA256 35a9d0a41ffc3fcc67dc174be1905bd83037f6877ea342b215559b9cbd8fd0de
MD5 70161999b575dc2975e8f88acb47903e
SHA1 cab7ccf7d66540b0bf3613a460a39ffa8b9920cc
SHA512 37064cbf406552e15c5d096b32aa2c758c3cc4f28152d38343e6fa1b7eba0c9c71f2f8e1ac6dfbc86db68ae226d95dbd35c05eb51b3f623d34ede8b877b80ed9
SSDEEP 24576:FnsJ39LyjbJkQFMhmC+6GD9L9GHcbOBiBiqyIbDLftVOPAxqbFu:FnsHyjtk2MYC5GDfuUbDZV0AwFu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot8360585127:AAGeicxRHP9hCsYhfQdAkFSMlzxv4toTnsI/sendMessage?chat_id=1673719962

Targets

- Target
  e-dekont.pdf.exe
- Size 1.6MB
- SHA256 35a9d0a41ffc3fcc67dc174be1905bd83037f6877ea342b215559b9cbd8fd0de
- MD5 70161999b575dc2975e8f88acb47903e
- SHA1 cab7ccf7d66540b0bf3613a460a39ffa8b9920cc
- SHA512 37064cbf406552e15c5d096b32aa2c758c3cc4f28152d38343e6fa1b7eba0c9c71f2f8e1ac6dfbc86db68ae226d95dbd35c05eb51b3f623d34ede8b877b80ed9
- SSDEEP 24576:FnsJ39LyjbJkQFMhmC+6GD9L9GHcbOBiBiqyIbDLftVOPAxqbFu:FnsHyjtk2MYC5GDfuUbDZV0AwFu
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

backdoor collection discovery snakekeylogger xred keylogger persistence spyware stealer
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Snakekeylogger family
  snakekeylogger
- Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Xred family
  xred
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2