Extracted

• • Target
    SecuriteInfo.com.Win32.CrypterX-gen.20023.exe
  • Size 1.1MB
  • SHA256 e3555cc65ec783fa2aa5a0c5c565e2ac373487fbcffd83db2a014f40ac983d30
  • MD5 fe150b611f87ce38416120070b0c83c6
  • SHA1 874a111afbb765814fb282ebaf097263a444a4c6
  • SHA512 9f3519a53e232423346f789b7cb427d36546bca9524f5ac0f674ed574da51a31ada7edf305c294c284aef4a987547e40958e2f4a87f7b833a749d4bf1d4475f8
  • SSDEEP 12288:K3dex1BWdg+jSEvuiLO0z/95ftCUucKdisMNocK2YD2E4Ep0ZFB:ge5P+lfJ9p4+KIlNo72YDl4L
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2