Extracted

• • Target
    iAtFmoJMzuIesfc.exe
  • Size 396KB
  • SHA256 a5873f85a8a3800eb3385730aa55e42df0e5a420b6d7bdfb7934a0872faebd4a
  • MD5 9ed3bac9b6f439b85e688e519040b826
  • SHA1 bfb2717b176e3e86affccf51f0f29cbed042d95b
  • SHA512 df123986e88f92c7c8bdebfc3eca8bb2c995060a334e67710f16b2bb4684b8816df908d1d038a1d9532f9d226407b3e834ec54c7f5fe2d408acc592d553200e9
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2