Extracted

• • Target
    SecuriteInfo.com.Trojan.PackedNET.1400.26598.30786
  • Size 928KB
  • SHA256 6069a9d373b71c1217c3415634dfadeed9cfa0baa4949d640fe515d92b5a8a27
  • MD5 2f316f3a2fbf43d3e2de047eda24e180
  • SHA1 774c7809d10a5c22ddd02283210e32551ab332e4
  • SHA512 33106194a66b6ca7963e74d042df4e3f2c3dbc4df32e1eaace99c46ddbd0144e5e3e1d63b6164684877334b09c13b500263977b1bfbfd3c004e429bd57db6058
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2