Extracted

• • Target
    Fatura20238278973456789055475.exe
  • Size 282KB
  • SHA256 150cabd834f0db43ad531fedf436d3788b9f7365c32e7d2efebf02583a178581
  • MD5 88fec319b45306bb6bb91d1cce4d8ad4
  • SHA1 1b080be709d61f2e9ba55f5aced35c1d886a82ca
  • SHA512 26828899e6119ad66e037499ccb6cd1d705d748d079970fe68a271182e2125eb63cd0b4bf419b01db5a081b2a9760146b156fd48d2f908cd6ab8249ecba491b1
  • SSDEEP 6144:tYa6ciPO8EArfqOM67PnkC4nr/uqe2u0xSsz9mb4Y/TYUPaLIP2cJAo:tYG02AbHMSP54nTuy9o4qEUyUPbAo
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2