Extracted

• • Target
    Comprobante de pago_978989689..exe
  • Size 576KB
  • SHA256 b22a347cb6ccdccbc3e68c48ed6ee69fff4526eb46a54d12e588e0cffc3e9c51
  • MD5 1775d05e9168c6aa50395be3477fe958
  • SHA1 00c5982c3c6e48cf831fb035d0fc54eecabe6bf1
  • SHA512 2e2e61833b317942c65a19c1625de059f4e1a9b843e37475e82e02ca4626c0cb3ed4d504040f27df0a23096a84990a00ce22a906e79f88583663cb171756e215
  • SSDEEP 12288:35HiU0xmJTkIS5hCSWc+bGP9c9UK86oWwUimv5MwOPQdRlF6J:dK4TFS64+b2KUR63wUimve1ERv6J
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2