Extracted

• • Target

    637c0a1232a65aba8a98acb8ec9787af

  • Size

    2.2MB

  • MD5

    637c0a1232a65aba8a98acb8ec9787af

  • SHA1

    30f6d7422526ad16c3de841472eb2c8ebfe8cb3f

  • SHA256

    3559806841a45de7e6ed11acf6085ddbfb7ca67781e1db676b844b0e92ac30f9

  • SHA512

    0beeb98cbcacfb3a3e3321774321c18a8e5e569a4ae08889b01a214762ef0cf73c5b4d3f452aea45d74240612a791c936d7c8fe62476b333e0d3afd6cc65a938

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2