Extracted

• • Target
    FEDEX - 2716436747964836.exe
  • Size 256KB
  • SHA256 af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6
  • MD5 7ec2931770c7f4965a1428a637c20ac5
  • SHA1 38aeb36b3f31aa8f4c08ecfd6b7c695297535160
  • SHA512 111354033005174ff0fb1490c057be9a4dd7a8367da75f75a792dd50e534580b6d4a09260419b196ca5b563c5faf2ad88dd3a9410e761149eb5faba7bad9c497
  • SSDEEP 6144:PYa6tVqxrPTiFxabi2tSRljOwqtrr8Y6+20eatd3X8jFDgFIi8:PYXVqxLUkbSjOTp6+20z8jFM+h
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2