Extracted

• • Target
    PO MM21PB81009AK32.exe
  • Size 798KB
  • SHA256 68ea38997c73f63cd68dea8bb6e2ecd5b5f6f5bf3a5f1597083bb674fdf3901f
  • MD5 11477d58c33da552ac32c7d4e43f135d
  • SHA1 1c2cc563267f8ff19dc031283d3e2e6793b37cb2
  • SHA512 956854632048a3a457d86b059c51013f15ba379dbf8039ea8a799cb9874e2b20a5456386ddd3bab8fe2a7243a6b2c3d0ab93fc3c65f0142b49d6aff4c4a52fb2
  • SSDEEP 12288:/p/KGhMJXFa+CLifnTRTqI9nF7uD8WbGQ:/hMC+hRT9wD8+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerkeyloggerstealercollectionspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2