Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.18529.exe
  • Size 799KB
  • SHA256 f0579298f475e4a98ec491ff10dc3bbab6ceac3b4f376a297ae03d36c177a09d
  • MD5 03ec30b2fcd3a41d6895222e8134793c
  • SHA1 5e14c6f17eab958bd0f5ce00ac37f00b0d5a198b
  • SHA512 5d84fcd34dc17ef28225876ced435ef27480de052e8e11faece9a5f72ef1761caa4aed38b4abb890d26666d5dea993e6dc7039b1f3055c2f7cbcc88c7688e57c
  • SSDEEP 12288:RK4HTN1UHBhS/PC6pJ2GpWZSsuIvOFpOspLSlu2fyLqrHF:ihSr5X8vOFUsBSlYLkHF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerkeyloggerstealercollectionspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2