Extracted

Extracted

• • Target

    Payment Confirmation.exe

  • Size

    367KB

  • MD5

    2a1a5cc3ca7f6824e6828bbf62d12941

  • SHA1

    563001a47df408ffca7d1d9809fd76d39d0ced3e

  • SHA256

    02d215970fa4a7280c152a5266161bdc4a8167bf384442f0c89039189d47f4cf

  • SHA512

    979ce4bc6fbade35dbfb55401816ae2149b4ece7d4defaa1fc822d1e426ca7c7016d20e4d1b84654076daf2f7f3025478f9cb80a81267370f34bfe46af0d8089

  • SSDEEP

    6144:RcfOazRkwtd9wSPqInJVwEjceYOtYYE2Odtyqd72fOsA:WfOazBD9wGDMEjcZlYrOiqoo

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2