Extracted

• • Target

    No. NS2ANNA REV1.xlsx.exe

  • Size

    662KB

  • MD5

    6c60453fe8d8d14510d88a2aa9deb625

  • SHA1

    afeb0c67c08e425c2786be2a86d1039dcabc227a

  • SHA256

    103defe5089465f983ce4e96852a172e6f3e3ae5edac58d366df916f0a189cb7

  • SHA512

    00cf6b6bcc3107775f2d1477b97079023302665d72696fa1e97e1564c95e42031b8e6e3d81c3d69b8aa652fa9eb5a93680cdec9a6fc3f4e8a1665975f08bc1c3

  • SSDEEP

    12288:BSAMTihh6xhZ6Or4zMjh3cIXlnYF1X5x1IOQakJxn4Wk3gmP75HPuP:bMUgh8y4wjhAF5ucx1gmP7pG

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2