Extracted

• • Target

    z25Solicituddecotizacion.exe

  • Size

    630KB

  • MD5

    70289d25b830cd80af41120874eb1ee1

  • SHA1

    ac76af075b1dd893200d57e6e9a3f7b24d476488

  • SHA256

    22b0dcc30c169644100916d06c39328f35a546a5b4a55a196dcc4d2b6a8197de

  • SHA512

    40c245c8bc5cdfd169abc4e7daadc7f90493a27cda447f27d403552600a33a72f754c478495ca98259e071113f4521423d18bcf1cca7c70eae82216a48d4440f

  • SSDEEP

    12288:F3QiGR0dBOzDiCk5mQ0LnQyxzERfZ7sXmGUoFmz0WCJVMRsK:VoAOzHQ4nPzuZ7s27Im7CJVasK

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2