Extracted

• • Target
    a6587ab37c4a9223fba53125790592a6
  • Size 418KB
  • SHA256 8d18af0f1e3f5f105b58caa5bc4954f6512ceae4218ce0bc9ab2e143fa5bbaad
  • MD5 a6587ab37c4a9223fba53125790592a6
  • SHA1 cff6d8dc0bfb07c9664075123ad8d259ff2027e6
  • SHA512 df62969ebd796f3ba2314ff22336677eecfc648e1268d275441f75ec43d681eb8a1ffb2acb09ce9e7a6c1531497089e587884e5b63baec0054f049beefe5b023
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealerpersistence

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Sets service image path in registry

    persistence

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2