Extracted

• • Target

    soa.exe

  • Size

    300KB

  • MD5

    7d62212773bcf9e580446648e300406e

  • SHA1

    2c34d48752e19374bfd12b670c5c3b2955730672

  • SHA256

    e9535fd8be2d9c01b5ae58735c989f2a1c4a69dfdcd9dc12ee5fb3cb6b44169b

  • SHA512

    a9765b1869d39a6dc981d4b64febeb4d1197314fecf434d1e4de85248ecdf4cc48203b1d66651c3ab76681d1b933138493e12c76d53962f943c1a2d8e044cb9e

  • SSDEEP

    6144:ce9dQrUFtDKZbCpN3Shzv27IHOpOz9aaMjubs4:X2UnKEpVvrpOBaaAi

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2