Extracted

• • Target
    92128c8f3c439aef08401ed5c8acccbf12aac06e59adc1c51e87ea04b3068d84.exe
  • Size 468KB
  • SHA256 92128c8f3c439aef08401ed5c8acccbf12aac06e59adc1c51e87ea04b3068d84
  • MD5 301b5e217d4d002d9d1959d65ac7da35
  • SHA1 ca6cb6bda6d959a97ad3ebef17bb4c528f75709c
  • SHA512 c0138e11e9ca7ffee88044359c59842a1021bfbd1e3cab9f03f3f2dc0842142db7ffe423e02b60f41ef3de0f9d84dbbc2980a607ed450fd5031409387dce9c95
  • SSDEEP 12288:+Mwny2t+oY2QGNkjVsBYp6PXKsUAmnlPgy2C4JLnlpY:+MwnyoY2JKuc6P6tayZenl2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionsnakekeyloggerkeyloggerstealercollection

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 b7823a15e7b1866ba3d77248f750b66505859d264cfc39d8c8c5e812f8ae4a81
  • MD5 a1da6788aeaf78ca4ae1dece8019e49d
  • SHA1 d770155e6e9aa69223be198c44a8da26a1756d89
  • SHA512 eada9c1528563ddfe3d4d8ed5dbc52b85a9190765535b68da90e6d623288bf0090adac5118e1ed6e3cb3e0abb9af025d3a2a73121413a4471a90fd04bc861e18
  • SSDEEP 192:uenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBUIwL:u8+Qlt70Fj/lQRY/9Vjj+L
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 48c290cf400a8e3a5e6cded2f4817d344c4d20745c8659cccbc09edad5866dc0
  • MD5 9cbefc918a4560f3e780bc927e0e4008
  • SHA1 4c23e9947f5d2338b4cfeb870cc9f9dcb7ee37e3
  • SHA512 7a11aeba9bfe309c9baaa9bd907218b238fd09a98c55c5d34949b8f5b4b6402e3efb7cb3279c211459cb6d27b689896c0a54ed92155d25f5828d18377a5b4bff
  • SSDEEP 96:o1svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YrJNqkz6:o1svWyNO81b8pCHFcM0PuAgkOybIFc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5behavioral6
• • Target
    $PLUGINSDIR/nsExec.dll
  • Size 7KB
  • SHA256 f19f36b3d8c9f78786eb2dc99d7c7ffbfa1c8236843f139c625a60fde3e6b4c3
  • MD5 59e487d0a38dce3f6be70d153d7b84a0
  • SHA1 0c2ca2fb13731c9f5c53d663dd3804a423736c45
  • SHA512 42c80f25e3e49a3a81ec20104feacfc9652410d50ef90020e61c889fb0e94b0e54e1214c37f205a9f180a56dc569628a62d2bed868ffceb3bb3bbbc842403735
  • SSDEEP 96:J0mkmwmHDqaRrlfAF4IUIqhmKv6vBckXK9wSBl8gvElHturnNQaSGYuHc2DCP:JHjRrlfA6Nv6eWIElNurnNQZGdHn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral7behavioral8
• • Target
    Varmtvandsbadeanstalten.Que
  • Size 53KB
  • SHA256 4dbe83fac3d6e5a4fcd305b7ea5b728b457bf09b81487bbe2fc24606af7c47db
  • MD5 a9d68f457fc528487643587340b91307
  • SHA1 b66f1efdff23cbef20fcc9a68473bfbc4a1e6dde
  • SHA512 0200c6e1c510b51fcc629c598c741bf6588ef2af5649ec9854fb2ab6afe258a56e5a75b6a7fe9d86da66dc95bbe4f10a0974ce6149ccce8962b24120a9e8e940
  • SSDEEP 384:2xe30iOYOxgRLh5XDlPoNtSRClKFsARZ2R7ZRI8hw+Io5uPCIjNYR3Re/g90KWVc:200QzCtNjAczuP4woNp7T6Cf3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  adwareexecutionpersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral10behavioral9