Extracted

• • Target
    60e71f8b40fe72cf44666a0a1718894e.exe
  • Size 568KB
  • SHA256 d0262aff1d34ef56ef2daeede0d5ee5a1d94a49836b00525ce4428198e5ace31
  • MD5 60e71f8b40fe72cf44666a0a1718894e
  • SHA1 ff86766ac066a4642d4ef06e920d8add76514af0
  • SHA512 1d0d9c8d3f8b769c51f9aeedb8edad4dd5b9a6d82f31e34a4cb5b25cd44a8539c0249a918094f2b0a726359de53dc4cdf2f13d3d414c406d72a71fd25d10b41d
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2