Extracted

• • Target

    Vsl particulars Packing list.exe

  • Size

    331KB

  • MD5

    d3a45a4458bdc6676f6b6bb93dd81864

  • SHA1

    33529558b645fc43cbf1febcc56726c86518a867

  • SHA256

    9c6b90bdb9d8d4644b131fa0a832a76aa81ac967ed53f7cec1c35b28e5babe61

  • SHA512

    b988fcd3d3dffe5346d4d864f0c2891a79fe92d577829e9c7f4cfab8d026332cb022a3e4c28346eeac2536a906e49596732351b6897d795c653f2135f3726722

  • SSDEEP

    6144:SncZ43mhBV2HzY/KTXve/nMLlEXmZv05lrTARHPj:fZSEBV2HzY/0e/SCmd0DXARHPj

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2