Extracted

• • Target
    Confirmación de recibo de transferencia.exe
  • Size 540KB
  • SHA256 9de26fd849696f46e6642548bb36fdc56cca315b717f95d7821e6520c2ea1b25
  • MD5 43dd4aebf369986fd6a5bad6fb865d0d
  • SHA1 1423b2c47cafbd5a623125da7f8f059adb4710b2
  • SHA512 6335a3bcf2d7e29bf14ec44e5ebdc32a796811287f98e5912150392f16fbfe3c5c7de835de57c228ab1dd4711323eeda035f806f0699b7c83f1aefa4f42c99a6
  • SSDEEP 12288:tGpBsLwY5cR8gPbNpRqyWd9yAPeiiAjSOCxG:tGsLyR88Jad9yYHdkG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2