Extracted

• • Target
    Document.exe
  • Size 892KB
  • SHA256 c126c825de9ddbbf35ebcd0f63205c80f769e55d95d27e1dadda8b5c9d245569
  • MD5 340f6a0f13f46a9358ff729ef7c97b8f
  • SHA1 69c24089f7ed5fa329bd61cbbefa7ae6182a12fa
  • SHA512 be0d94db27a1bc20667a4771fd6910f2472c0973faf7d24f8e2f6a0bac5766854c62f138bf0f62f96e07822470d7d8f8050b52f32b84688c266c8aedf0b55a18
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggerkeyloggerransomwarespywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2