Extracted

• • Target
    a413ad7ac1514409f8c5c84487ae57fc.exe
  • Size 127KB
  • SHA256 6e465bbc2fe0c1a5cd112367facfb57b11f10c9cad8fa10514d73a977cb636cf
  • MD5 a413ad7ac1514409f8c5c84487ae57fc
  • SHA1 1b40d3632d62ff05ad93aa9e02cfef4e0b3d1cb6
  • SHA512 62e22be2b475fa971bd736aa6ddabeb5e67c29e79c73d440125b571c9dde7d722a6d14566854d3c21539770b1a8a395f4f965793c2bb1c4f8d56240705e2b848
  • SSDEEP 3072:uzRJAs3QPzWJ3H6gfzO4Nb8NRwBl2FbY:slN7Jbnyb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2