Extracted

• • Target
    PO_PT089110.exe
  • Size 801KB
  • SHA256 86b69e37fb4f94c2b24904bbb004474b8f57abecc6332ff595c1eacc7ab59bf6
  • MD5 2a3eb8a59a40ff2bfb4fa812c2ef6e72
  • SHA1 1d9e724d345107cd210db376597d941bd7ec12a2
  • SHA512 0a857e5b6fb463ea8b155bdd8b9dd0e2c4723977bfb46618a283f6c822a57b3fdcc60e3a13fee0f42e90759f8fa13186251ebc0e0d36f2fd19161fe41261c524
  • SSDEEP 12288:BwpfEuE8NAKs/P4fxoDe8Hh+MpmiQcG5OmEBe2syEufWZNK9RPfDYU:qbah+MpKVqsqZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2