Extracted

• • Target
    0eab169ca241fefeadae030e857f87e0.exe
  • Size 559KB
  • SHA256 f354ab2b18c8fcabbc94123f41ce225fb9ec4adaceafda7c5fefd61dee656f70
  • MD5 0eab169ca241fefeadae030e857f87e0
  • SHA1 45318abcab2aa2b9c91057cd100d930afe315129
  • SHA512 8e3cc8417758c7199ac084fbdedbcac46df9b9fce4d6855443eaa13594a44fc3d9bff35452c25fb376a1797be8b11a538cbdb21254683dbf1a90b13091a2b139
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggerkeyloggerstealerspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2