Extracted

• • Target
    scorejp PO No. POR.03912022.exe
  • Size 892KB
  • SHA256 301f88fbd40f05dd85b6b7c42241c092caa0ab3da6b77aa39cd80b1e14bf2c98
  • MD5 c24e1740a83f06095a92a0c3fb9af941
  • SHA1 41a7957efd577e18fd6d5388d094542f77f6db79
  • SHA512 db70b52e75d3572386932ed0e26766c296cb34312311f3e52c4c7bcfa78ca154392488d3c46ad47f2cff20fcf8862d0dbe02d97656e5982de69b62d3333f5de0
  • SSDEEP 24576:/b7qjJQ5B8pnzT1fsUu0Rm6SvHZdNaBc3:jsJDZvpo6SvHZHr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2