Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.13435.28378.exe
  • Size 637KB
  • SHA256 b8f6dc528131c71e9cf1d4159f825054e25ca7e5d37cf33b1a6b4dc9b74ca6b1
  • MD5 9f8e53fd08a5889e3b82fa3cf17f348f
  • SHA1 7fcba3d4616ca828c2d8afd90e27ee0efca0971f
  • SHA512 02afddfd6812b65468bcd51e728a687048fbe38f256582bbf5cb7b38016f90d6e2885f4543d6489e20b92674a7de31cd480c74c08e7784735822b012387cb1dc
  • SSDEEP 12288:Magh/PsZ1DX/VDJd1CwfGErRDUqR7llgT4m/RUDNs59tEuS:Magh/P21LGMQqto//RUi
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2