Extracted

• • Target

    Reporte de emisión de documentos (Compras).exe

  • Size

    364KB

  • MD5

    b211311150252298d3c3bfc184c5e489

  • SHA1

    4a2ececd857827438d82292c09b0411d7fcb0eac

  • SHA256

    0a6d84fb7b04d799b786683bd1ba6303bf9ec3e1b0f640fdc15a8fe19634ceef

  • SHA512

    4781ea7ec09b00f52a2e8cc4b51e4a58acde3a79d6bbf6f6dcfb568af5727952040a81fe075cde02f83c40c3d5c929ff91f0e329eecbf84f67fea5d4338af67a

  • SSDEEP

    6144:yFeZIiH2uwVIRj0CSUasyjgqAkzL7r9r/EDppppppppppppppppppppppppppppd:yFeZxW4jVasy7P7r9r/+pppppppppppP

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2