Extracted

• • Target

    Inquiry Parts 2023-10.scr

  • Size

    769KB

  • MD5

    5effabc97480cc8fb3cfa6833d20e5ef

  • SHA1

    168c4247f596a89f73b081b20e214a74feed0109

  • SHA256

    18984ef29316e8b0ca4423e4f17418b23ec54e91bb7809ea5f840d03b618d987

  • SHA512

    fa77e8e1e805a98e46773b3a2b2301bff80134bfb764d8cc4b1b1563ec3ab964a82ae519582288c5f9e556d0964ae9c1c8c50c5d564be6581dc5091f757eb6bd

  • SSDEEP

    12288:CRvAblxM/xBzcFyHcJNdWfpuL19aoI+39k68:CRYbnM/Xzc3Nmpaz++h8

  Score

  10^/10

  snakekeyloggerkeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    RFQ-1199211.exe

  • Size

    768KB

  • MD5

    21724c44495555e825f87cfc2b119bcf

  • SHA1

    ea70f6fbebbb74a5c5b5b204136877b441f72da0

  • SHA256

    8f86f0d30b96a4ffaf93e9726caefeaece8d3298534422fb5c5337ad8620ee59

  • SHA512

    009c7fce795a64657244a7b581d58ed161360f29e4c8bdd5a5d6d395604d611f15504cefdb0944372aa0bb9f3a0d134bd4d869877c1e0c5d70efd2074a7a5d9a

  • SSDEEP

    12288:fkXrDAYOu6LykBv6iWCj6SUptA8ghXDyQZE6+n889c4NcaiTWOo:fkfAQdkBj6S+GXmJGUcailo

  Score

  10^/10

  snakekeyloggercollectionkeyloggerpersistencespywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4