Extracted

• • Target
    shipping docs.exe
  • Size 618KB
  • SHA256 95108beb38c630b45cadeecaf511fd73c31d27bfb45166dd7e0e93a41d1fc744
  • MD5 d15a7cb5af024a17931a95d3ef009650
  • SHA1 1311e928c035ebaf79e53b383960766b9c05a54e
  • SHA512 f69a69d6579e96578ef6f01e6d4aee3bcfa4c1f5a3347687d2380cbe3fcaebda8bd4abae03ed94cc459e001e0f2ac2b2143fc39a2e85ebc090ed4db15638d456
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2