Extracted

• • Target
    PO_287109139.exe
  • Size 1.2MB
  • SHA256 d44d3dc5889b2f476fcd9413aef8041b692d28c11ae9f5f24018aeaebe35f7c0
  • MD5 949cad1a7c79addf4709eb939fb058b9
  • SHA1 bf3da7c138f9718dd00f2f0122cd094a00666dd7
  • SHA512 e54a7a183b0a72cd1d201606b89b16ea5b4971c23ad1571bcb12c7ba0ea70708cdd93da96489273cc9b88582751a0f03cc6b5d909113b36b133ba0d1fb9bd425
  • SSDEEP 12288:BxJras/Zin99XtY512YU+AhSvxtMyzgI8epdAJHcjezsBGIMvSAHNY:NrTS9XtYj2YuAQug+C8jezs8IM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2