Extracted

• • Target
    DETIL TRANSAKSI.exe
  • Size 807KB
  • SHA256 2074e69e2dca9b62f9162d3a49f4d86d728f1dafb6ffe2f648a5bf4da78d47b0
  • MD5 323070bc9a654db328a26d44f2e8244f
  • SHA1 1f93d009329105612220d590f775b98b92c05b1e
  • SHA512 de4b14a9a32a6cb56013f84f3d853fb90e1d612d1eb8ed2f46ced7fc23d0df5988854e5352ebbdee5c7891b9d08f7a6dc48bc2f9b095a725bdec7d048fe101c9
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2