Extracted

• • Target

    Mensaje Swift MT103 anticipo del 30%.exe

  • Size

    587KB

  • MD5

    3341f173f0721ff20596b776b7a92d32

  • SHA1

    6fb3226dd28c16d1223546acce7b5e11973e1c6e

  • SHA256

    db518b1b20c2bacd07d2150a675f12b47b07cb303b0070295ea2a74dccc8385f

  • SHA512

    7b054cb8275ebd2882a4a45ce83fc90ad9ba40cc32939653d9757bee2a84b124dbe38896e3edcfcb382b1538013f15c1a1afe4f7de320c4ff5a007ab3321d680

  • SSDEEP

    12288:UjEkhMOoltiJCxDopdCKW2YrkflyUpR3Ms130Ya1G9qODQ/8i4:sEkh5oDiJCip4jkflyUEsB0YB9Bo

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2