Extracted

• • Target
    REMITTANCE.exe
  • Size 38KB
  • SHA256 3d955138d85c7bbe64d91faeb3eb453df585d86409f1be0380ac8ff34e734fcb
  • MD5 9407fce1c210dc29df719aca133927dd
  • SHA1 246cd6bd0f09910e7ed174fd1dd23629cbcc9054
  • SHA512 ff63ef7f7f7a0d89c0c8c4105a362468c8028570c679f0fcfb51c0d54b1acf71dd02e1e6c1456df8fecd3c6bbf29768acdbad19c0e9b94edf46f8020c655b9f7
  • SSDEEP 384:TVMnUtCORCQXulaiAMwCKFH2S3dd0hUADkamrH5:TOnUdRCxlmMwCK/3deVD0rH5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerpersistencespywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2