Extracted

• • Target
    CTM USD28600.exe
  • Size 637KB
  • SHA256 d949ca75c623df13fee31c1ddfbe02655d866a5408f3140e250090f213ec2f3f
  • MD5 5deba7bbc15bb31bd266e81e902ad15f
  • SHA1 59c8d3214fb772ef91642d954f7d3642243ff565
  • SHA512 5268860fdbd15d85ad0ff83b3f45b90f8303fb2d67e733d358b4e18654b5fd2ba8710346ffd9a71727a96166a80991bc0af8cb684e66b87682e3f704603b1eff
  • SSDEEP 12288:6YydsNXjfbZA0bWaFkzmHf0FBq9QcREKrPJscT7cFnU:63sVsaFkzSkaQcEMJs5Fn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2