Extracted

• • Target
    Purchase_Order_11_19_20.exe
  • Size 715KB
  • SHA256 18d86210ca1721632ee4a17030313ca4c9f60aa0657d83a6cc576b9889558eef
  • MD5 e492155e4d4cab9522ef4144234c8069
  • SHA1 97694934fc9e0caf9efb751e687ca7290f79ff2d
  • SHA512 094a8f459e10e20540cd0fc2f4cc8445aa7ac1b720eed0636fb8baf24cdda39a3f7b20b2e8d964bc6f2f15fd95847d721e77a1056594cd0d5ccd907c76812217
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggerkeyloggerstealerspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2