Extracted

• • Target

    Quotation No. 001515 & Quotation No. 001518.exe

  • Size

    1.0MB

  • MD5

    92ea59584143492a9997cb726c50cc2f

  • SHA1

    e921858b54293bf976396bfe4ab73fd5dfe6db1d

  • SHA256

    09f3ffc4cf39c48f84b8eac7c29a49f9c1c576fd7c804a18374ee0e93d69bc37

  • SHA512

    289d9e48cad3c994fd66ea9563e6563b8f897f92fe283c234e307b336fea757de19201dbafa8a1f843657891514a53dbae15d25e91d72c7aa2b6091687510f16

  • SSDEEP

    12288:fFNlzMJr5jdij0pkTiS4+cN1283rsnBACiTt28yNa3yagV:tNlzMTjdu0MiS4+YTABAC4t3MafgV

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2