Extracted

• • Target

    FAC0987656789000.com

  • Size

    529KB

  • MD5

    3abf7470f1bf525962a46c980cff0b23

  • SHA1

    eed11e6be7a63a53e5b12a4ccf3d442551d2429a

  • SHA256

    c9e937d287a7c9fe7de44c0003b64e3a20e47bbe30008be2a0d9d9a57f57e5d1

  • SHA512

    75c6c239ae025bcc6feee598c2514a016d3e3857cf3d6b3afc10cd8326a3afdaf4a5ffafc25a9a0199d68c747cb59ac42e684f07aaa384af41d265e9aaf7cc62

  • SSDEEP

    12288:ZOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiv8dj1dlsqAIj8IbqRxBG0yt:Zq5TfcdHj4fmbVfAaqLU

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealerupx

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2