Extracted

• • Target

    11f9cac2f85d8bbf3f11eace2c7cfab7

  • Size

    792KB

  • MD5

    11f9cac2f85d8bbf3f11eace2c7cfab7

  • SHA1

    1befd0c0c655f178408021a8673abce558c0bf61

  • SHA256

    b39bd1ae1083d02d4e5a1fcbf34399e5bd28cd3b2b2d9c9569f26143767feb14

  • SHA512

    c9aecfd140f9eeeabe428083dc499afc9022a5caba66d1c8d0941aad20264a3109ec1e661b4040f9a4cf77158850f1ebd3ff923c9e0048edc0faa0bddfe43cf3

  • SSDEEP

    24576:+gJJjCOsBgo0q4wMPCadKqDpDtWUFf3JaC6VPk06iDj:+MdDoHMPvdKqB3JL6FkU

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2