Extracted

• • Target

    Swift Copy.exe

  • Size

    809KB

  • MD5

    fe640080409e16221716866bb65a463c

  • SHA1

    1a4141f72426b226312be73311a5c22b5f75f55e

  • SHA256

    53c8a7b825f04fd38afdcdef29b21c18fa2407597277de780252a18b733af1d2

  • SHA512

    b6197680f5d6c36422cbb35fc50eb2a4263fdc8a8d89014cc32d1dee2935673cc0387dabdf7cfdd59ffd2be0fd2684115288f0a0fe0faa4de68a3632febef414

  • SSDEEP

    12288:67R8VFAxQRADqjJ5n6fd5hJWs8C8E1Hj3NseFQ3d:6uVFXjr6fdcs8E1Hj3NseFw

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2