Extracted

• • Target

    EagleAsia08appointmentletter.exe.v

  • Size

    682KB

  • MD5

    0d7cce35f88ab81372525702aef249a9

  • SHA1

    046c8ca2470a0e71d817fca08ffaa5d9b31dfb70

  • SHA256

    97d0510ca5b726fb79ce77ed97dc5096310bc8fda449bab20d15d7386826b057

  • SHA512

    1493f0c9cc628a1f4927b088de5a6717391773346ac209cbdc323d659dc39fe2f9c8675dc63d9cc8676cf1c0084655dbeea2fc18810654dfb485884c8e533e0b

  • SSDEEP

    12288:E6SUmph87hSLSKE7alDgV1Nx2tho3WcJeIuMpm8+ifhBlv/FJ:8zj8FSLfef/No7o3VJZRdzX

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2