Extracted

• • Target
    DETAIL PAKET DAN PENGIRIMAN.exe
  • Size 1.2MB
  • SHA256 fe4bb12b2ffb98b15958481f1fca5c2f5f5bccda79cf5e567b67db78ff125919
  • MD5 44d5a336cce7fc77896a5cf1c78f41fe
  • SHA1 79ba1d0c09898fbc6244748f8c73b872114d8160
  • SHA512 ee8450a6e151e4d6e9095314fb466f38224d91cf1afc7a3956d733c0ebb78e7ad08c8f980234f7286a32ba9a3bc1ac34117fbabc90c1edd09c033c4983ae4e8b
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2