Extracted

• • Target
    1d8fc153356e79e8c46fe1599c2e6f55.exe
  • Size 404KB
  • SHA256 76027f253ef7f7754a5813d939e23abaf53fe4bc4478d3f80bd09eada7419a49
  • MD5 1d8fc153356e79e8c46fe1599c2e6f55
  • SHA1 f734e3767cf4d29ea9cc201fefa2d6c1fb56d9f1
  • SHA512 e1dcbc0e8c37484279ee2a3b24c6ad14ce42e507358ec7feb42e854bbd5d441fa81157bfa0b17455cb030eaad3e904bee7ba373f1141e7c8f98b8c41f1649cde
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggerkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2