2021-09-15 Snake Keylogger IOCs

THREAT IDENTIFICATION:  SNAKE KEYLOGGER

SUBJECTS OBSERVED
Bank Instruction Advance For LC

SENDERS OBSERVED
info@mestashippinginc.com

MALDOC FILE HASHES
Bank Instructions Form For LC.zip
ca16bef676700c517cdfe956a699dfc8

SNAKE KEYLOGGER PAYLOAD FILE HASHES
Bank Instructions Form For LC.exe
caf0d841fd66d1eba09c761970ee011f

SNAKE KEYLOGGER EXFILTRATION TRAFFIC SENT VIA
https://api.telegram.org/bot1926537393:AAHGSUhtLeQU8qms_2blDH9qpvo-fEuwi9E/sendDocument?chat_id=1664748411&caption= Pc Name: analyst | Snake Keylogger

SNAKE KEYLOGGER ADDITIONAL CONTACTED URLS
http://checkip.dyndns.org/
https://freegeoip.app/xml/

SUPPORTING EVIDENCE
https://www.virustotal.com/gui/file/bc25a5e78d1fb42c16545b220355b7b48a41b50da666f3c1c1b902b5bd8a56b6