Extracted

• • Target
    CTM USD28600.exe
  • Size 330KB
  • SHA256 855d156285ccf04888dae255256e42682756098471514f6155c7a5ef8556a95f
  • MD5 3bd1eeda6a67f41edca8f6a999b10985
  • SHA1 4eece89fd7641f537ae707a506e85ab155d44946
  • SHA512 fff37f22a044ee18b57f5b1b72ec5e4a1643ed77166a479ebe4e47ef7a6cac8e294890f01f92b5ef859283ac8a315aa2a103600509f5064c1b3cb3d5f9064400
  • SSDEEP 6144:imDFBRi1qjhf0SliwKSrKlQX0oaFDX+EiaTKg2O8C:imDFbo5S+lQkonjg2O8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2