Extracted

• • Target
    Confirmación de recibo de transferencia.exe
  • Size 964KB
  • SHA256 bf2ac49736da80ef10019505cd99268e2baf344d2f16e838f63ffe85501d4dd0
  • MD5 288068f18a58be14a7e37a11b110395d
  • SHA1 eb68c8c593354b2527c0038214d6430a227aea88
  • SHA512 26e50a754390d03283655ad20915dce7262072794ea613ffb27b316fdd164a84be333428cb9c1af639e53c38a63fdda4e535a2f9fcdf1d119903895a3d9d6a3c
  • SSDEEP 24576:J12zVZ97i2zzJvQm5d4oTv+0cEVfL7C0x8b:JAR37dJvDFT20cEVfC0xi
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2