Extracted

• • Target
    Belge.exe
  • Size 1.3MB
  • SHA256 671f0f796fe0e636ed14bda08bb4d3b5cafbe9d5b9ca1dddf929bf9fb9e3a372
  • MD5 ae0ab5bd52117b75a6b00a1f92a8de15
  • SHA1 fb6b4ca18d65f8bc1f290cc1286c364a8ba3f81f
  • SHA512 3213030b939902f29acc2170e105451a611ec6a9c2818dae3ebf9f177169530dd4fc6336451b66d24585125fed30134a1a0d33ba280cf71153908b294d54a810
  • SSDEEP 24576:5wk1YdtnrDoHnOQZVjwNMkstZ1admlJiEvP:WkCHnrSndVjrkgZIdwiE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2