Extracted

Extracted

• • Target
    Appraisal.exe
  • Size 530KB
  • SHA256 96282ae0c75bb56416f86fcc7891e115bde36d92cc5137873f1ea6117564ccee
  • MD5 07e1e7cc431f63a3237bc9d273f8edfa
  • SHA1 8ad46b17396f375107ecfb06fb5d8fa61e1563ea
  • SHA512 01afe99bafa7bdf13d02260f74bd0c3897887de9e22b43138b0a87233d868d0ea8e18a16dae3d55de89451bb307e4dcf8f0217e0c7e6fb62ff2f47f297d73c54
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggerkeyloggerransomwarespywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2