Extracted

• • Target
    SOA OCC__1.XIS.exe
  • Size 126KB
  • SHA256 e025af7bc4bb0dbf0b95e49de654ff94bb046214216043a4dbd8697da70eded9
  • MD5 c07c8e7143e288b8f6055b2314ac0cd6
  • SHA1 85bf086d0d932c48bf62f966bb87ed0ac9783425
  • SHA512 db92ee79f50287f39c660413036dd011b15650588a6c637bae426f329091692339fa8a248526c8dfeee614f0e3944da5e82abc04fe0044a482df18a128d1d29d
  • SSDEEP 3072:yIu/ws/d6LgdTxT9H1xb8rQ5ZwBwtFbY:qhdHXb4QHTb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2