Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.18853.15996.exe
  • Size 796KB
  • SHA256 f2b4cc229354335ed435a8d1f8d46f5faae4218e2482de7fcef20e6783c65e61
  • MD5 97e27600770a6ccc7e794a17a3337db6
  • SHA1 2e3f5af83302055aa5f17e681a3125b38d28b6bb
  • SHA512 c998ece31ad24ea5b3d9af007e48a1746aedad53e28daea3fcae807607764452158566949134c00d58594016f69c639739c487dde7cf76ae5b47c87468504cbc
  • SSDEEP 12288:gwDfEudoLYslDSjSjNRkX16HTWevbxn0NiHI1JqyD6LmXQaSA:PSYslDSSjNaXYTWEn0KI1Jqf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerkeyloggerstealercollectionspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2