Extracted

• • Target
    Transferencia de Monex.exe
  • Size 938KB
  • SHA256 c4dca47e265d7d05f515f8032d49d032efb0b11edcf5f20bd6da322ea85d8379
  • MD5 8b2b862f91f01e7518151bd26d4e4a96
  • SHA1 7911614c3539a364ff53f70c26359293897cf648
  • SHA512 9016283eb46e5ebdd2389724edc0fc66fb0dc675b0d745028c9f904c4a5b1ffa6c59218c764a947c8889feec59f6f81911a2806d6e41b8f0eb55aad042964a06
  • SSDEEP 24576:FumaLmb7gh/02RBimHLyEV/RRyy1RSwp0BWdc9:Y5ab0h/xTiULxZRz3/EW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2