Extracted

• • Target

    Particulars.exe

  • Size

    637KB

  • MD5

    8c9b28b619c100d356d5e3b0fdc9a14f

  • SHA1

    36d1fc62ea14becfee3096ad5659426b167c5488

  • SHA256

    59964ec33307df609662c22b48795f45a8c8b02cfed07a0cdb4bc06b465ef380

  • SHA512

    8aa9ff7401a8200646f3fcffcdccb94e20c763896e9187b5198faabe8c967002b94636941f85c62d22594b1315a8db5cf5df3c4f14406310cc8f54a6a6219b66

  • SSDEEP

    12288:6YydsNXjfbK0bWaFkzmHf0FBq9QOREKrPJscT7cFnU:63sVAaFkzSkaQqEMJs5Fn

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2