Extracted

• • Target
    1 Tera HD-250Qty.exe
  • Size 1.3MB
  • SHA256 1a3ce7daf20ceb145a8b1045043e4368a6ac1b1ef13f71898faf5855be16948f
  • MD5 8f602b38b79c7c0d429531f91b563df8
  • SHA1 cac3f98aa44c6a78e441e06e86e20d2ed1fcba14
  • SHA512 ce21dabe8dfd066b307a69174d2c2cfa8c13d4035176e13247c057ede89cb7bf8e88a71edc22fb651462d513bfcf0e83033fa4101cbaa581bccf6e1fb201380f
  • SSDEEP 12288:OfvNA7CasVXrfc6edGlc3r7O6x+GR6HZmlk4GcPy9h6JHIxfNj2lQXKp07:uRakf7lczxF2ZmltPi6JHIxF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2