Extracted

• • Target

    9CvlgHlOLlzWXSQ.exe

  • Size

    571KB

  • MD5

    f1acbc2d02bd58f8f714b4128c5bc488

  • SHA1

    2001ccfa7e5676be545cac9e1c57742717bef72a

  • SHA256

    fe7e20398259b50b7f70c189ef64b2458c16dd04e720834a4250dcf8410ed36b

  • SHA512

    cec5af8cce1ec1c8b81fac40ba3f7b411330efe5934bb7a5af5e5f44c871fd1adc6e91694bb79c269daf1d354648ba3c37406f31b21d97ac4cda7bfea7617060

  • SSDEEP

    12288:awhuJCQvhzps7QK1TJpujadeIgRpXb6ShCw78h3HV:huJBs7QKfoja+RF69k8p

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2