Extracted

• • Target
    4aebc08263b56847190f3047bfb8bc7d.exe
  • Size 568KB
  • SHA256 540d75b42f199e0416cd6982b4a962f5ac3029f93681682a6187eda2ee2bab42
  • MD5 4aebc08263b56847190f3047bfb8bc7d
  • SHA1 8fedd60e162141c9cc3684aebd9e2d73be8458ee
  • SHA512 a769e16fa0976dc5595da71df46941fec41b13b95d70f922d0238f37c760f830cf4317d9afa45723691763070ce18a166ff7aed3f5ec2268eddb2401bdfdcb1b
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2