Extracted

• • Target

    Items.exe

  • Size

    1.1MB

  • MD5

    33e45814f3c1275dd6da5b547674814f

  • SHA1

    9949ed071dfac6b97cd32a5bace41189c5e1a30d

  • SHA256

    da95d395b0b5e06e55941596614a1ecab0ce2a999b3330fc780809f194da9ac9

  • SHA512

    979d41d774e7a0149e57cb02a30b60bd697e44c60f9c5e55f172b7ec3c8b1be5face497e25b6180e9fb90860c23ea20ab2ca3cad2bb76ca5fb4ac842637eb258

  • SSDEEP

    12288:NPIdc9Nd6rciswM8zLmJWGsbKX6gnBPbVnbR/4ve:5wc9dN8z3LEBL4ve

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2