Extracted

• • Target

    Extraccion_Asepeyo_ECC.exe

  • Size

    340KB

  • MD5

    70ee8b692e67cb2d4c9ef93b9a80030b

  • SHA1

    cbea44f294f7cf40da91470f078a961f9645d6d2

  • SHA256

    84e316ba28c1745989fcba630c13792daa4286bee90d828d9eb6e9f36d86f4fd

  • SHA512

    5fad2808729481998876b62b819ead3f28b12dfd80dfb11b43ebb4d121c3c46e46294afce87038210485bbba1c6aed8b927a4d47e1d89a01829e340b9be08712

  • SSDEEP

    6144:nQ606xUAK/TxV595DDV3pv/LW9f6Mu18qMnDf0rXkOEjFX59vtoS7FJJcFg:k3LJZ3pHLW9fG3eDfkCx3vtVJncFg

  Score

  10^/10

  guloadersnakekeyloggercollectiondownloaderkeyloggerstealer

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2