Extracted

• • Target

    SecuriteInfo.com.Win32.DropperX-gen.28977.28876.exe

  • Size

    206KB

  • MD5

    ee6b384c6e586e89dde5d50ecf9a2d6f

  • SHA1

    dc02b8f12a36dd0dddefeeb1309c31087cdaa9ff

  • SHA256

    8e627235423e16db6f6686775f30e07eb8e2ae1c7c8db9a7bd49083c8cb7f7e1

  • SHA512

    fad7441920e67cd4f9e002ae58113f97b9963b3f44f33378d2e8c99eeb5a79a9bb3a51d5279c5ab36ee3717eeb3174ae7a9b67217b28fca37354b4ec26951dd3

  • SSDEEP

    3072:zAKnjNnCDDRvLGmrOAOkGt6+duWA/t/SHUebbxCbGgKk12qk/oPYm21KLbDoU1s9:zDstvLGtELbMUTKZD

  Score

  10^/10

  discoverypersistencesnakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2