Extracted

• • Target

    5.exe

  • Size

    50KB

  • MD5

    a4ae05762502813b211f8a85ade4aaf9

  • SHA1

    d8ccccad0ec7dd9ada63a9b7b2f318d5c2bf7345

  • SHA256

    ff1a81ba33a6328568c2c3fa6c02d90909322624fd07c76d9fb300e56d47092a

  • SHA512

    4ec7b4063079e418d1b7a7d4a81bf823976fb22aa3011914420cd95b1a0f7a0a7b36e3b6a2edbb5395c11c71cbf800747fc2cdaea9fa5fe0ca6df0ee59041dff

  • SSDEEP

    768:hYkXQd1NrfaBQrpl21Ic6ehe9cy3i5j6Aw6/hnkz8IkOWHQki8T:O6Qr8QrMryp+WIhnO8jOWF

  Score

  10^/10

  purelogstealerstealersnakekeyloggercollectionkeyloggerpersistencespyware

  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

    stealerpurelogstealer

  • PureLog Stealer payload

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2