snakekeylogger | be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb

General

Target
Payment_Advise00383567.exe
Size 1.1MB
Sample260504-bx7dzaex4k
SHA256 be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb
MD5 1913e28feca43789194ca4a1aba6d1d2
SHA1 f971b067958ee65d9a2af1a7569c50d7147ad70f
SHA512 b411fab30a3067fd74d141b8c2965b4e5ac02f398fd96b054ae16734e5a9c1ab824aa7237dcf0fd397d7bc790b98a2ce49696099122a4a7bc2061a4e44177c8f
SSDEEP 24576:tbE3RW+ZP732usMNODIyZSteIyc9x6x8PqrOUvb5V4C:tbKo0jNODIyZStWK6iSrOmV
TLSH
T18C359D1DE38C11E9E22BC134CBA66232E771785A0761BADB075AD6152F73ED06F3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
mail.thekampungubudvilla.com
Port
587
Username
[email protected]
Password
thekampung100%
Email to
[email protected]

Targets

- Target
  Payment_Advise00383567.exe
- Size 1.1MB
- SHA256 be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb
- MD5 1913e28feca43789194ca4a1aba6d1d2
- SHA1 f971b067958ee65d9a2af1a7569c50d7147ad70f
- SHA512 b411fab30a3067fd74d141b8c2965b4e5ac02f398fd96b054ae16734e5a9c1ab824aa7237dcf0fd397d7bc790b98a2ce49696099122a4a7bc2061a4e44177c8f
- SSDEEP 24576:tbE3RW+ZP732usMNODIyZSteIyc9x6x8PqrOUvb5V4C:tbKo0jNODIyZStWK6iSrOmV
- TLSH
  T18C359D1DE38C11E9E22BC134CBA66232E771785A0761BADB075AD6152F73ED06F3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery snakekeylogger keylogger stealer
- Family: Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger payload
- Drops startup file
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Snake Keylogger

Snake Keylogger payload

Drops startup file

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2