Extracted

Extracted

• • Target

    Fatura n. 24.exe

  • Size

    602KB

  • MD5

    764fe6da2d63d33c57105a7f193de2fe

  • SHA1

    c434951ca63e276b09aa1898575144b3f449939d

  • SHA256

    221d2dd6e3f557fc5706b3fc70b7412993265406831e7816d0732cd3087c023d

  • SHA512

    05ff5a4a10db9e4885b18053bf263833bbceceffe3da6697b3805e1a51eda6dea8b8744fd5ef5b4d89c2d527ec0a304f3a89e09906f8a56814aacc6aa3ce7c2f

  • SSDEEP

    12288:IDp8J0xn/G06CmodxPBJNdUMIP3BxUrDhH6wS4ASI3nevf:lJ0xeUZPNWbUrNH84rff

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2