Extracted

• • Target

    MV NYMPH THETIS.exe

  • Size

    484KB

  • MD5

    e9c41d12687c5b97c5a3b2fee59e16e2

  • SHA1

    33d59a8fec12077d69746ed1f50fd0aba7021444

  • SHA256

    ab82097ee82184d7ca685960209805a8c83b9f28cc1eb9619d2704fe8dd54f48

  • SHA512

    84f6d288adad08d604a89d5b97f37d82df600554a0cbe281b3f46ab3295725e9b4051497ba130880df7917ec7f10209be85da363faef9bee35ea7a1283c3bb45

  • SSDEEP

    12288:y8G1KBsGhcbWFP7ariMg2WMN5IAk3w0/VwDZovH5UP3:2YBfhcbMzargujZs5UP

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2