Extracted

• • Target
    Fatura20238278973456789055475.exe
  • Size 434KB
  • SHA256 492e3ab5e47e3e41d6bfeb3edb5a4e09834331e4473e0d28cd1541088c7d009e
  • MD5 75192ca6d5f41d544dac7e6a65a76e50
  • SHA1 2003afc249c4488b8961c00537139df00ef7fca3
  • SHA512 b9515082589810d14a95e1940ef7b79b2be8c0e124ef02ea4ed92af583490904e1e51d730cb4f6cac0961eabc9ed06d93617bda1f74beeb1823efa258570f275
  • SSDEEP 6144:uYa6KD9M/UyOYsw/rguvU35CM12/ZB+pW8GmDfQgD2wVvaG6KE8jGpTeEa:uYg9M8fYsCps35CM12f+s8vf2wtaDTYp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2