Extracted

• • Target

    SOA.exe

  • Size

    645KB

  • MD5

    b0be16b78d21ae5c42c8309fcb54cdaa

  • SHA1

    5777abdce97d2d3382bec264a1f2ebd9c9623e39

  • SHA256

    ac77fcbe1456c6fbc62e66bece175cc00a33eaab4353830c7fcf25116891ceac

  • SHA512

    4db8ad2d31d2cbb5d32a22376e4571483161ea861d3babcc501857c9b70fcb9fc78f1af70e44ffc2efd9af495ec411125494a61487f8f562e59f02330b82214e

  • SSDEEP

    12288:LXk1tn7HeIlPNodfFP6GefzDK9TrcfQfHBWLb9yV55hTVbBb:Lo7Z1odfFP6tWVtf

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2