Extracted

• • Target
    0d675e32b9569ca22d557a7b8eb59bcd.exe
  • Size 647KB
  • SHA256 16cb706c2c9b5e91f30a44e3dd3cefe4e0554cca4d84de71f7acbe5aaa1d5a17
  • MD5 0d675e32b9569ca22d557a7b8eb59bcd
  • SHA1 9afc3807bc75103f597d46ac4921e0760f4dc389
  • SHA512 ba5b517cf2533e62557c33d4a550b788c17cd186f8f290eda916e4733cc5f405e521156acbedfcf8822b56904c02d49b5b5ec0cc0627a446ec95aae74bc9336d
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2