Extracted

• • Target
    PO52024.exe
  • Size 816KB
  • SHA256 c6e1df8bf12734eb6c733eb4902fa73a1d1b431dca5ab7b4501ec030c4e9f1e0
  • MD5 fd29fe806b0ffbceb3f3250e62199fad
  • SHA1 4d685278ac209d8ba698e4bc421b82c50f1010bb
  • SHA512 5deb960258cf637aed2edf8d38c34bb1ae9b5021f7b68749aa4c99ded0fe31788e429030b4a4492d83ffbd545da41a66d5ab6e24330a25b0fdd7f249561ad0f7
  • SSDEEP 12288:Qi/9WflU/9RCEGIxCmbjaTpgfAmjAxqOD3qCIOJozpW:ZylUyJKPhfBcRr1J
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2