Extracted

• • Target
    Nuevo orden. PO.exe
  • Size 797KB
  • SHA256 fc4e2ba1dc3c25186846ec42f5ef46d77cb31dcbd8065445ae7a597323a0f0a7
  • MD5 a9d1ad5cde7d461e0756e1d70bb91d7e
  • SHA1 6dff669d182d0814f9cd72a49af5cb4252341df8
  • SHA512 2b99c68cd453247181ab678e33de52edd4ba9f4509b46473104fb89b76dfe2f81e951a2adb5b39f4b70af0ed72ff629049d7d6ca513e0b9aba2a0f18c33690dd
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggerkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2