Extracted

• • Target
    Q178101_Quote_221007_1415.xlsx.exe
  • Size 928KB
  • SHA256 fe33c22faabafd696535976eb75d55862b2f32339536c87f32775f0152c53b06
  • MD5 23f6e3cd891a4a67b82549cb993b4467
  • SHA1 e6a9420a4a3f8187fe11486fe70b3943f55055b9
  • SHA512 70dddae29f3eb3405136b566de2f2cd84d3063b0b73d8a1c3a695c060f75802cf5d9345881f07b4f4ab6bfcaf74c9fcd12f22dc1be3820c9bbf926d4fb2362f2
  • SSDEEP 12288:cUwN+z+ZoEQd5HWc1XLDp9az6dpoMMAmmBaogj1CGRTsjAQSQy4A:xWolHJLl9rDoQabeAtQy4A
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2