Extracted

• • Target
    Original shipping documents PI SKY0003 SOFABED.exe
  • Size 679KB
  • SHA256 8e783aa82453ce82e341fd65c7114f56db7eb5941fe1f88cf201fb24b2f14d52
  • MD5 9e5be6aa2f41c01804e8228c88ebfdc9
  • SHA1 5b12d258ff19457a5750c67d5cef5bb15a85169c
  • SHA512 f397a63416789fa6f38ba387118a0d86ec0598539aaa23e144441c982e20629618dca0d34262f124eb480b33c109de9bc9538be822766b82cbb53aae35f4fe5b
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggerkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2