Extracted

• • Target

    SEM2024000002383.exe

  • Size

    748KB

  • MD5

    06fa51d68f2545f28a2b942b01a4bb13

  • SHA1

    74fb1ce042c1982155d6d190b446dd429c7ad463

  • SHA256

    fb79dfe6e2eebbe7882d3e688ff377c3ffcfc8d41f35e1af16f224846f4fab5b

  • SHA512

    a11d5b3fccfc2cf03913903382b2521b609bd2d798d50e6b151c8a88f1cb835456e0f1ace18c50037de6b93c656f51b88e783fb42b80b38fd3be0d772cc5c773

  • SSDEEP

    12288:jG6QMVyGP0Fx53cAA0jGnheowOyGOs61IYZVAecgs9FMa1Mdq8jJM:jG6QtGP0OhsGnheowDGMIYO7MoOM

  Score

  10^/10

  discoveryexecutionsnakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    Synligstes84.Hig

  • Size

    53KB

  • MD5

    453a8e6a5068ae5a2e5d99de31a13b3b

  • SHA1

    9f202a5b9a8cf1ae90030e14ea99c4e787338ede

  • SHA256

    4ac6b7ddcc88b43191a8e1329e632c3246b10dcd077b1e79efa2f0559cafa7f6

  • SHA512

    37b6296b2434b1791d7e709d17cd8bcce6d8111505648b63227e1004461de31d07922497ed80be4e6ab115ece2964394cf6a3c1b26725a3da2fa0bb3cf7cac46

  • SSDEEP

    768:GgwhUiC0xg3ABPAquhRXdzx0upGLv4rMdpnLh3AHtDeXqfEF8zommDR/q+UjEadh:mUiKwhuxzxJpavgq0DeXqf7oYPXEw

  Score

  8^/10

  executionpersistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4