Extracted

• • Target
    ETS_0100000456_06321.scr
  • Size 330KB
  • SHA256 c73a8629499a2e95adf6ec545b360f49d607fb8b737ab5a26020d54b37df8b8d
  • MD5 611c09e5728dd5e48a31da53902f74c8
  • SHA1 b088d8118dc4c243cd698015f3533ecd187a89df
  • SHA512 700eeb0dab0e65250c6cb10c0548c5b13b9dc081453a0480835b81aa11730602a24670e874d93a0fd04d3a3a1b2de69b315624720575a9bd987c200afc5d4cba
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2