2021-08-12 Snake Keylogger IOCs

THREAT IDENTIFICATION:  SNAKE KEYLOGGER

SUBJECTS OBSERVED
RFQ/ITB PROVISION TO SUPPLY AND DELIVERY FOR INSTRUMENT ITEMS, SPRING  HANGER, INSTRUMENT BULKS AND PIPING BULKS FOR WD-A05/A17 AT WEST DESARU  (WSS)_Rev 1 (PQR-7943-377) - PIPE FITTING REV 01

SENDERS OBSERVED
tendersecretaryhuc@pbjv.com.my

MALDOC FILE HASHES
BE-IZ-Q-1278-21 - COMMERCIAL.IMG
3a348dae64cf2f9acf78a43031a72cf2

BE-IZ-Q-1278-21 - TECHNICAL.IMG
3b62ecfc2e494f28cddc9cd39e7ddf3f

SNAKE KEYLOGGER PAYLOAD FILE HASHES
BE-IZ-Q-1278-21 - COMMERCIAL.exe
a9a010a85cb57506786a428c95b7a982

BE-IZ-Q-1278-21 - TECHNICAL.exe
a9a010a85cb57506786a428c95b7a982

SNAKE KEYLOGGER C2
Not observed

EXFILTRATION EMAIL ADDRESSES
From strings in memory:
worshippersnake@fireacoustics.com

SUPPORTING EVIDENCE
https://www.virustotal.com/gui/file/50e5974917f1a96891cc54b4eada0c5b3f955df6d6dbeb4772ff05e2f203ee9d/detection