Extracted

• • Target
    skplop.exe
  • Size 601KB
  • SHA256 3dadce1408b6839c8fba7894c84e7d2dd74e5eaa6bcf42e3d653b9a474133564
  • MD5 05be62096d137e878335639ddf749a44
  • SHA1 8c9a8d73432686b0f274d3240e7a3fdb2aab2b54
  • SHA512 11c7492db827af3dbd9fc242e75e380b80cd7a2db219fbdab9b94f8b7b3bfd9b713d447323a0a9e06408228d575ee1b467327f5706648d0abec3be4e46b33fb5
  • SSDEEP 6144:fTouKrWBEu3/Z2lpGDHU3ykJwsWVqB0qC/9B/53qKO62e0BGFi0MN2c:fToPWBv/cpGrU3yVJW0qGxqte0ei00
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerpersistencespywarestealerupx

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2