Extracted

• • Target
    0875PO.exe
  • Size 1.1MB
  • SHA256 18ea5ebd8331a357b54d5ab5b08db0bce05f8c452cabca6ff56fa2264525de9f
  • MD5 c9a9a0e731bfaccda38a9ae33ecd3829
  • SHA1 6ed0b7b0fc1a0a94536d0172a10fc5f61f1bd559
  • SHA512 333de712dc4b3d304b70d0a0bf395b00565dc082d4c02d52a60055aa941dba5d6dd01a8fea90e5f43745a96e28a3400e70ba7ea37f8bc3b51eeb3e31b0c81613
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggerkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2