Extracted

• • Target
    DHL SHIPPING DOCUMENTS.exe
  • Size 609KB
  • SHA256 2b3bc8ae8908f619944ca14696ecec764b92d6ff891838d1a7fe951580b8edea
  • MD5 9aa60dbb387fb942779632aa429c30f3
  • SHA1 d917e01d4421d1004009ffd07bc4bdbd9f650725
  • SHA512 4f6a1a22c38fddddace685cc4dd1f70c5107df99c8ca104ad0a9f0386aa1b3bbf3a262334214df7d0d2bf8db905f653f89146d36d922b05b07e1f5da69c7a002
  • SSDEEP 12288:GouHH1Jy2iNFw29GfSP4slM/T19+DDHo7vPn8YiVpA/N:lu1w1ZGUabT+fI8Pg/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2