Extracted

• • Target

    MT103SWIFTCOPY.exe

  • Size

    1.0MB

  • MD5

    db5d4999d491974cf4cd6deebd9f5d4d

  • SHA1

    a9f32ab5a58bf859adcd6f5b8db13cd14396d135

  • SHA256

    dee8789f76e8e43b7f34b6ddcba8549f196b22eb8f7cf50d9580004a6ab9c183

  • SHA512

    f8f252eb99ce93888505b6661a86df20fcbc53ebd99f4281cdb601bcab05666e339ef3344104b1c7ba36627597b3428edd1947987feafce4922d79982cc23d8e

  • SSDEEP

    12288:YhdjSCMZeu+fMl2sKHDlas+ivlHDls4Ceyo/0xJzWZAm:YnjSCYaMBiTMxYAm

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2