Extracted

• • Target
    MAWB 057 01237622.exe
  • Size 729KB
  • SHA256 c1af93073fc2a1354950f2d745782986d860da36bc1d4a3fb2b61c9354b339d7
  • MD5 1b74c3b743ad0d1ebe8ec784674376b8
  • SHA1 397a1f093bb19c9a1c0651575f7d0fb75056e3b4
  • SHA512 ca4c5a3fa7c06eb715427038d04e670312c28d7e815fbcbebefbdc638058f4df8e0bd3a99524ad554e910935a412057f8be7d4cb9f0bf39f0e43e1846be9ffc7
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggerkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2