Extracted

Extracted

• • Target
    a14324f8142cd1b88a13dcd78763696f.exe
  • Size 651KB
  • SHA256 b3290a3fbb515f16464cc229377af2fb0c4e54764db5be91107523849acec6de
  • MD5 a14324f8142cd1b88a13dcd78763696f
  • SHA1 e36db93c1031c85a7c272b677a6d5c08c1d3f442
  • SHA512 26b19a0f2076530a300d3e5bcef70eefa6ba9578ca97cb04ff48f73fa6bf8e1f553711aa2452d4d36eb671d45a748a7e2034f133f101232ccf8007267904d28b
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggerevasionkeyloggerstealercollectionspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2