Extracted

• • Target
    New Order--catalogue--quotation--PI22005.exe
  • Size 486KB
  • SHA256 f22041afa2bfc2b588ff3e01f3a8b866dc713c7dfb2aa142561d291f00de1c5e
  • MD5 cd77627ca78da8ea456638093cc85d89
  • SHA1 9e541209a49e3795547062d4bd584833a1e0300c
  • SHA512 582558620c32d4dbfd496d59e7a2e986b76fff73f5d78c3e24e026f40ba088e5fa60bbd1145584fc5735d2a4d4a5b0168be4eea7fd52d04bc459a67b53db48e7
  • SSDEEP 12288:OCih7jh16VJLUv5IS3r5ZvGXlFMh24lC7ElGD:O1haUv5v5ZvGXleh2c
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2