Extracted

Extracted

• • Target
    Justificante de la operación.exe
  • Size 601KB
  • SHA256 f328c0cde7df997ea2fd271bd3096b93f28fb6d93b06e5894209684b9f58873e
  • MD5 b7ff59206cce32e8b10a49ce5a4bc241
  • SHA1 2de1331915aad6fc66742ab6f191b17bd6195225
  • SHA512 371ef23fb664e0009c56b9147ad96118d6c0a216f267b9ca5222ad7c01497421d61c881fcf14ff97a7fa5c319d122a0ba415940b6c36dcfe00c9787de9e489e4
  • SSDEEP 12288:J2N8jiZ4zypIPshtPplTY6RhKuAE202dj4xFtol68Tu1XrFD7wgKk1QReek5uC8D:J2N8jiZ4zypIPshJTDEPu+kkgbxwgK0i
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2