Extracted

• • Target

    Webxinfy.exe

  • Size

    424KB

  • MD5

    aef95313f585ac4fcf3fd9b6c489b286

  • SHA1

    d0d887a33c18e6b70f4e37fbc0e1a384b33b476c

  • SHA256

    b3dba4262136858ea1c87d1aca82830267af72efb7f509faa21dddcec066bc89

  • SHA512

    97586a81524469fdb2d49778006a7b6d42b14a871e9b346572551374692fe55ce16337240aacbacb90ea3dca0dd993e96a4303be5f037cb72df00d97f2b93704

  • SSDEEP

    6144:gVBZhKsN6+zRDQSsFv9CK5uj2rUHBwK67AfsOgy2tCeYYHrMEzvwe/vy3VXB1:gFhTOllCKsj2njAfsOgtzvZWV7

  Score

  10^/10

  discoverysnakekeyloggercollectionkeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2