Extracted

• • Target

    SCAN_24879583298537753.exe

  • Size

    1006KB

  • MD5

    ddd6176f833f0823f0567807166a7069

  • SHA1

    6b7c6e31d9e4126dd8d90910c5bb23ef1ea0ac8a

  • SHA256

    fd2b31e56f78ab4ffa163d79630236303472c19a110e5180ee53e576b3de4b66

  • SHA512

    4ba999c3cd44517985d81594caa57df0fc592210eaa6acfd9921a653154fa1d0eae41fdd9d69adedd046822fe38339e2d2b8867bdb9b460447bb968942db8bf2

  • SSDEEP

    12288:06HxvHYNxzUJm8Nfyx/IJmAoUDXbg5kYUhRKKlnipsNrARTzCdyPu+o9uS319H01:0sxvs58Nf4IwTGXbyaFiIAR3CdyPrF1

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2