Extracted

• • Target
    Invoice M470031261, M470031262, M470031263.exe
  • Size 549KB
  • SHA256 83177bc5d78b3fd5054543d6fc65d16b4576be79447ac5ee894a4b3b330e3764
  • MD5 dc00d2b56bb23fed420f83b247f298a8
  • SHA1 8c997a7a5cd4dce65352b89c695741c6c172d9d4
  • SHA512 d73f79a7926babcd05d17c6021a9245a93dbcc3c9fe86cb2d1234170808ea26311a688521575d8146f5bba589e55e9d3d0df21420945d8cd2f0e54e42bfbdb4e
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggerkeyloggerstealerspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2