Extracted

• • Target
    SecuriteInfo.com.W32.AIDetectNet.01.12429.29772
  • Size 524KB
  • SHA256 b61637ba04ff710d17dafb8d211b30833ec0ea1f3bd45b6314b2677a94a4164b
  • MD5 4c16309ea000dd9b1eee89058ad3a9bc
  • SHA1 03e7f71e4937a2f84e112dcc2f475d670feb0c1b
  • SHA512 7aed57114a2f185d037bbdf07a9c4ff0039f20b67536e90eab615b3a4a17803732579080204fa221dfcd2432541a809c2028e8d1169d6e9d6ac5dc2489b5892d
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2