Extracted

• • Target
    New Purchase Order--catalogue--quotation--PI22005.exe
  • Size 760KB
  • SHA256 45bcec65ba80215780b0b11379df70016aef28cbcf7c46ac71b625934b85e76b
  • MD5 ee9b73a467565dd77d16b51f76e1d3e6
  • SHA1 bcf47c9794d53fef81354a9931896399432db3bd
  • SHA512 57f9c40a789624d7baa252d657573d9485372a6b35fa433b16dfc458dca3ac99e103898a22086bc57a9fceaf089e300b70f2a69d7800f78e4d527f117ccc11fd
  • SSDEEP 12288:ETt79k/8eYcfVAyzAkzqPXlA1slz/zE/Bj4Haiypo7564jjt09fFu/a3bQ:EBcqhVAGlwikG3fSjumbQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2