Extracted

• • Target
    cf648d0d6dc000fee07dbd7b6b04d245.exe
  • Size 767KB
  • SHA256 dfdedc4060f4944298bcdf25778b7f7eaaef43fdae61238d7debf88825e66294
  • MD5 cf648d0d6dc000fee07dbd7b6b04d245
  • SHA1 28fdfad4f62577cfe3ada300e0697742461e6e39
  • SHA512 04b2836ecad721841ce56d356e1e14201a7a1a6f798a0bd9b51a3f1cdeb89eafe64614f46c2ea71f37e0993526eb3b7894be1b886ec721d45f5e60c44d99dba0
  • SSDEEP 12288:qo0YV0J8j5czSBqgXqBf3CSrd6JOosHTWLgtQ5kls8cKXtLyTrjAc+SdgkY:R4WBqzf3Nrd6v+CklFcQOTrCSdgkY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  guloadersnakekeyloggercollectiondiscoverydownloaderkeyloggerstealer

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2