Extracted

• • Target

    a8b84e503c11cce5530fb019cd43a0306656dd22e78eac4279a332b00430ed8d.exe

  • Size

    982KB

  • MD5

    031f538bf91234929b1c3975c36691a0

  • SHA1

    ca89f6797c65c0ef1b3c6ea914863d60c36c54cf

  • SHA256

    a8b84e503c11cce5530fb019cd43a0306656dd22e78eac4279a332b00430ed8d

  • SHA512

    2d2b5601a5074a37ab9e95b686eb91d880cf04800e816d3af94b3b32492a8fdf16b5ca32b0ab176b21c1474493dccf3cc47c8c0032caa7ee80f42660f7bfc2c2

  • SSDEEP

    24576:1Ey7VAyDXAiHWuYQBfD6YA1dHycx+GhCpG:1l7VAwzBtaS4+6CpG

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2