Extracted

• • Target
    Payment.exe
  • Size 450KB
  • SHA256 8a4ec5658fe3c4d9ad343c32d041285949986d1005a443224d73ffb32cd582ff
  • MD5 f2bb77d94af8e4ea1ba92b6ad18ab890
  • SHA1 502756ebd8c68e4d3b9e9abc2d2e604e774a256f
  • SHA512 a4b4e521ad1d18cb046cfd175bbc144eb9d14fc59b1bfb86b8791a8baadb1cef30761efe8ba49d38ef8547b3b5cf84222e63b006d67eede23d014b23f99adfe5
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2