Extracted

• • Target
    New order _xls.exe
  • Size 54KB
  • SHA256 5fc33b3fda224e85ca520da99c6caed5bcfef8e0e29636df90b2ff4ca16a9abd
  • MD5 5f879e53e945fe24f8885774f36d4b1f
  • SHA1 04876d8b3b65590d2067e8e52cbf555d2763ace4
  • SHA512 b55fd7f68f8210d5397ad73ec9db5ae5d92977616084f3faab14f4c29e9009fdd755c8b7b3dfd3c4464a5bbd10f1540def85c37fc744194972ce9e950d2042d9
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2