Extracted

• • Target
    file.exe
  • Size 555KB
  • SHA256 52aac6cc862bfc0b62b9462163696c0f2c8bdcfcdf2c84e6548ebc6172d3a74a
  • MD5 a9eca07669d2e2731b5a9537c0f4adec
  • SHA1 8c2713b7edff3b62394d26b2c8425811ed3a536f
  • SHA512 d0eaff23083fe8ee143dccaf73f58ae19ebcced8390c42521aff016688165960f502ae2a892edf5be5138ad512381d01cf125985d82669a97d64246748d094ba
  • SSDEEP 12288:QtGetS7mpVS1UUeXvHuflhzK4pcWWFti0jErdq07kyLL1XXMQ:CG6OSS1UUW/4anti0jENoyLJnM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2