Extracted

• • Target
    8f46fee4149f63bb206c2b7c330e9a2e.exe
  • Size 457KB
  • SHA256 6a0c0119eeb0974da7b05c895494b72c5a1da124aa18aab2f5a7018c4f2bb7be
  • MD5 8f46fee4149f63bb206c2b7c330e9a2e
  • SHA1 b98f1de3f63fb9224b542067b8475d53f14ef85a
  • SHA512 a78dd29280b71b7a3f055d4c79bc7a1bb3995cf4ca8c343a7ac35eb4a3909c5520854ba02b6a2bfc41bbfb7aa35ba09c1e671a8e5574908cba2c830d55d1e16b
  • SSDEEP 6144:uiWB0G3ouHEm20W+gGIU4MeUNg0f11KHbAz3S9QTbeKQ7NPIHDNPsgSJ2tGgcFUN:DU02ouHH1J+0f1o7Az3WQPg2NkJng7p
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2