Extracted

• • Target
    Particulars.exe
  • Size 359KB
  • SHA256 a344900c765bf7cc1a01c780e0d1379bbe3deb68b7f66230f4b889ea29aff75f
  • MD5 6126845d1f357240fcecc512ef7e7611
  • SHA1 45a37c6d98817d2b7aa69845532b8e4897196bf1
  • SHA512 3b6fd37b2c3167a11631cfec901663e753aaf0c48617b31153be872eab95ef617714b00dc203022148baaa1eb08622ade4b5a9a68451a7172313b7d47439128c
  • SSDEEP 6144:LhVWpINxgPBxs1rE98xVgYjkbacY3ZOZa6ZAEh3dGq8OU5QIu:L6Ki5k498xhVc4Ua6bGrOJIu
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerkeyloggerstealercollectionspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2