Extracted

• • Target

    b5c3d613bed886b4af1631fea8c24cd3e2d73b4a14885d640be56de05c2e637a

  • Size

    690KB

  • MD5

    1f2f188536e58972140279a1fb1cc731

  • SHA1

    ee2ceb30d49c7689203b04b980fe0238b5c30c09

  • SHA256

    b5c3d613bed886b4af1631fea8c24cd3e2d73b4a14885d640be56de05c2e637a

  • SHA512

    e76c8c3cff7fabf9772182d64309569aa1c1fa49e0f3e150a75dd93fde8593f3a6b3def58b9e0d85c3b386b2286f391832c0e2ad4d3f3ab7113e6e03d0b4bce9

  • SSDEEP

    12288:bVRY0hGZATnfxBjXqZllykeFAiyiVWv+Nc0CSoOL:3tzT5Uc/ai7wWV

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1