Extracted

• • Target

    MT Griya Bugis Agency Appointment.exe

  • Size

    685KB

  • MD5

    bae2409b9a15978efbbb6e9b2efac95d

  • SHA1

    dc97a0db7a64f1aaf64c1f91ad2af04c962a5a8b

  • SHA256

    335a4d0cba30db171813535723437e49fef1ca6adb02d8e201742dee4fb07242

  • SHA512

    67cac5e7cbb21e6972c6786088e889f43739399b99b67b3118d4996413b7a6a52b758c3485ae0a68e216985759d37060ff8a6171079372ebda01e48c34dca07e

  • SSDEEP

    12288:A1obJvDjvOo4V+tPQdx81IYaHMqL6AwETv:AoBDjvZRPQsEsqbBTv

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2