Extracted

• • Target

    eLJyojaW0RFPJhK.exe

  • Size

    278KB

  • MD5

    6c218e353026cac8c9aa59fc494a14b9

  • SHA1

    eaed3e0789b749dc2e188fd26a9f9cbc50314d5f

  • SHA256

    b2acbb9c56fba0cbe5cabd76b5df537059df5644958924ec3ee7d8578666c9ba

  • SHA512

    3cbc6e0244e9178762afb5b13b3553204c30f6ada1f2ee1b2deb9764a2156ab6d0ab2741087915c7351811aefaeb1c364d9d256ae571fc7a8948b5d75fae4ff1

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2