Extracted

• • Target
    Comprovativo De Transferencia.exe
  • Size 764KB
  • SHA256 a4ce07acfbdf7bd395f263bd86c3383bfc2d2f21be8df21511c1d37fa40e59b4
  • MD5 512f88a21575218c350b40823a4137a6
  • SHA1 df8977ab5cbe0f6e02674ccbcb23182a514b5a64
  • SHA512 4634d5003a39432d5612357f1a4dfa76a888d401004879b00371da43acc7651a50005c126c6674a868ffe92291d5f5ed38f08294566a527cb538594ed3c86aaa
  • SSDEEP 12288:fx+OSUAh3NVeb2iNa7xdvo/MdyrhFgtDsuBHsSj5J4+saBGfWxEZPS84XB39hRao:X1U9BqmycgiH75BrWZ6B3lakavYepwDG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2