Extracted

• • Target
    New Order0005.23 SOL DE COT 02.exe
  • Size 930KB
  • SHA256 7a43e50091e1f6a5a80e4e3b2f246a067f94ff7e85067ee9f98e11225fbbfa9f
  • MD5 202db6bc3833bc044590dee37a655c44
  • SHA1 99b790da44a670baee5432b4b60789271fbb2195
  • SHA512 cb349b2adc54a796b09d9f5e6a2a8ec2d018ac9d236cb682347f0b61537fef436de7b77b029aff48dd42b37986f6f2a762aef808cebb31cacaab6886f9ed5236
  • SSDEEP 24576:udtxlKOz1SFKV1ofNN4YoFgjO6O3i9WEuFfu7O:ud7lHz1rTGPxj1WXfu7O
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2