Extracted

• • Target
    MV GOLDEN SCHULTE.exe
  • Size 637KB
  • SHA256 cb970671c87c5ab16a4dcdbeebd306f103250d7fc0b74f83e711383f4cd5495f
  • MD5 94d1ab9bbee00e3c1d25735c015fd5b4
  • SHA1 5e0bae77d89191897d1fb9d1fe0c2ec0566ea02c
  • SHA512 c765bc612018ed12bc21a5d598a2057f209d6de468b5a11e99ef0494cf8d15d7b678adc51e2a1c52bbc9477773d448451a138e473ff6bba3ca3c980f89b9bf28
  • SSDEEP 12288:6Yydp/qunaA29M7ZCx5NZwBUBRTlY5ugie6PKrPJscT7cgnU:63JqEl29M7ZCXNC6MJs5gn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2