Extracted

• • Target
    MV GOLDEN SCHULTE.exe
  • Size 637KB
  • SHA256 9727ca1c125f58f6be7bb529b9e5dd3b3ec49268e74f94310d876985d98de915
  • MD5 65cdff442b96de6c0e6e26abff770326
  • SHA1 bcc58c00aad021846bcae135a8115c55264559bf
  • SHA512 1fa015828422392f1b71fe5f7f04739b8c64f7f8112e1e648f566e036d8869869bc9a8a91ae0a94b98042307bfddfa2110da1c111ee5610e97b69413d4f1ffe9
  • SSDEEP 12288:6YydfiA1BFSi6R2UPwYOccmotKrPJscT7cDnU:63fiAJmOYTiMJs5Dn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2