Extracted

• • Target

    d756511151c525ba1a658e046e922e8a

  • Size

    1.6MB

  • MD5

    d756511151c525ba1a658e046e922e8a

  • SHA1

    b3b68c71c1286052cab24f8f245836dd410110fa

  • SHA256

    4e17b5f9b4b0b5c568def305d3c73b997a0191684632912f43fcc89894ca6f2b

  • SHA512

    316dcd2e8e677811305fd4313ee403abe10aaf2dcddb537e882aa327895a0fc69892ed3457a0e943031a7cb1f5cda5afa0a9df502eaaedff11bd779c1cccd158

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2