Extracted

Extracted

• • Target
    4fa7496f89719813a3a49388a40b3f20.exe
  • Size 420KB
  • SHA256 2aba0c4fef3e985688becd223af4bc7cb964d0fd7bdd06302bf09fede4dd3fef
  • MD5 4fa7496f89719813a3a49388a40b3f20
  • SHA1 ad70ecb1a95cfaba10c5e322bb77ad7183a4da9f
  • SHA512 a2f9a608aee29ecd4ca7983cea86563b62946ca7c6b8ac276ff76044dfb5f30c7996bd754cdc25b9901bc3fd02e026330501b060ceb6c206bc5181ce73b114a0
  • SSDEEP 3072:qyNb/EAi2fhN0Pm1jo8JjrRTkKty3r1Ub6tWvpQTRXBRTWVxpQ7KLp0pRE5EVk:XbsArZzR5h1tLutWvpQTRXBRTWu7K+j
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerwarzoneratcollectioninfostealerkeyloggerratspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2