Extracted

• • Target
    Barclays_02286101XXXX.exe
  • Size 582KB
  • SHA256 65111c916600ffd7c9407db3a70147e7333a2d6e504c049c548e58db09a6ff6a
  • MD5 352eaf4c92b29e7dee9c5825b4a4deb6
  • SHA1 90d4fa63571e84d4fc826150d4cb3f2f7195825b
  • SHA512 d5c0e616e7a3559e69966af0ed831778396a5b9a1eb19c48ec33a1f66e0036513e9f5e1769cf3a099bbfd6e6cd077f6e054892e062f836846c013097dc34c367
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggerkeyloggerstealercollectionspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2