Extracted

• • Target
    2ebce7c0afe9095dd9e4b2b5f59b78c6.exe
  • Size 754KB
  • SHA256 39edc6b40ed1d675da1bc6897249db064df7c1e3270cc3168c97b800dbcd7c15
  • MD5 2ebce7c0afe9095dd9e4b2b5f59b78c6
  • SHA1 deb234e1d09019280f9d1df9a7cac46c6d95945a
  • SHA512 0c5f3f25e5794885afa1e19dd9e184fd6d3cae6191f6c75b9c7374a31abb61f780de2d6caa2f89db6c30d09074552c7fa7ea04885d46a4053752eb43d5d25524
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggerkeyloggerstealercollectionspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2