Extracted

• • Target

    SecuriteInfo.com.Variant.Barys.27469.30346.22408

  • Size

    673KB

  • MD5

    1ddb617ccf9bb45f887a9d70fdffd6bd

  • SHA1

    722e7c9e7cd517bf03ae537acee7cba7165c603a

  • SHA256

    4224a72bf65b59dc526f385a0e2b13adbbb305b0ae3133cbee5a8dcc32ee7d75

  • SHA512

    bc2137d66f3760dac16ef6b852575a2715d5adf9f7f46e626880e6f9bd50bbbe5c58ae3158c6d444e258294ee63327d0a8608ace8dd2f0890722caa57cc8c723

  • SSDEEP

    12288:SAoQ1izfsWjA2LTJWwc0bYAxPnAcx/ZGp2SGSgrNRca1OEAmD:7PchfJAGhG0RpRjc

  Score

  10^/10

  snakekeyloggercollectionkeyloggerpersistencespywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2