Extracted

• • Target
    SOA-MARCH2021.exe
  • Size 608KB
  • SHA256 36b13cc741fca2cadbfe95073659e055dac4785163c4d551fade6a9f9237128c
  • MD5 084b2fcd3abda51ce9c56bfd7fe444a5
  • SHA1 89ea767f66c4af8a8c27b892fb1d4ee01c2f5325
  • SHA512 48005cd998b0e954dd8cb6381fe4179da906efce1868498d51c7e5df2d1af788d87a1fff04ba9d97445fe5d97bdd7be04cd0d5001453f0eabf142875c4efe3cd
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggerkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2