Extracted

• • Target
    SecuriteInfo.com.Scr.Malcodegdn30.14543.19096
  • Size 865KB
  • SHA256 5f8726a70210acce4b0c90d578efa854799a5bf7bceb8d2fb10854b83f2f0db3
  • MD5 d2d8e8905d69011b34b177964e22c8e2
  • SHA1 27b627a50d34b9639d6bb26820b32e6456a820c1
  • SHA512 61772143a06e8995fc1fbc67100f66438c32c6a0761f81a12436d9b7162480454ea907a90a8ca9253aa5992e59e5af0d5cafd6930ac3934b2a4c58f508401675
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggerkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2