Extracted

• • Target

    utradvices.scr

  • Size

    1.1MB

  • MD5

    4422a3da13d83812a791341547d90b9a

  • SHA1

    f39d4f3253723193fb026cf197e9c6f53dce0d78

  • SHA256

    d04c3e48cef9f341aeb06fd70f68e27d57d7fb9a63b575033dbb7cf3c6455ca5

  • SHA512

    96ba7b79e9952f962aa1e98c7a43964aa21bd4c0a7abe5889a0597706454297a3348d2cb8217996573875acbb7eab52a414cdd3b43c7b8b603d8e49b4366cd72

  • SSDEEP

    24576:wSu1S82mBVrIiudqVmvkX6QwkbUl4kVHFviLoLU7C:wSuU82mTVTX6QKl4kVHFviLoL

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2