2021-08-31 Snake Keylogger IOCs

THREAT IDENTIFICATION:  SNAKE KEYLOGGER

SUBJECTS OBSERVED
IMP/ EXP // COMMERCIAL Docs
IMP/ EXP // COMMERCIAL Documents

SENDERS OBSERVED
teamloading@lintasborneo.com

MALDOC FILE HASHES
shipmentCustoms documents.rar
a9ec073f0b842c3bb82f01831d6c72ad

SNAKE KEYLOGGER PAYLOAD FILE HASHES
shipmentCustoms documents.exe
69b982b35f003dc6e9ca1e4b5ace2274

SNAKE KEYLOGGER CONTACTED URLS
https://api.telegram.org/bot
http://checkip.dyndns.org/
https://freegeoip.app/xml/

SUPPORTING EVIDENCE
https://app.any.run/tasks/2c585179-f6fc-4333-9aee-7cd42500f9e7/
https://www.virustotal.com/gui/file/e407dd4b4f51ada8d176fc5fc692f78818aabc3e8304aa7692e17674148ea17d/detection