Extracted

• • Target
    cuwIPSJRPD84W7R.exe
  • Size 798KB
  • SHA256 1cdc9031e10db3f5dc4f931fac2c91e3ff73f75a4182888ef445f280f91c1dff
  • MD5 38993bbb102c49782a53caee1c4693aa
  • SHA1 8a8dd76b3b5f7086b09c23d12d5751cee7af1817
  • SHA512 1788b04235375587660406bbc73c10ed76deddb1c23080b5391f80bb6b9b8f2816f0191e11f6fd23779f9bf6163c859f8d574880e240cf5b07fc003d8b00b4b1
  • SSDEEP 12288:ke/9WflU/9KwIG0e2MJHXCzmWra+Pn/dUunvR9njvLtXc:BylUdUhqrcdd59jvLtXc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2