Extracted

• • Target
    3342dfc7db5e520f91be03c19d98adaf.exe
  • Size 986KB
  • SHA256 45ee7fd677dda19356451ef24de0d55b3ccdb5b54c47b5b053a1cf7a280736dc
  • MD5 3342dfc7db5e520f91be03c19d98adaf
  • SHA1 a8f3138c347c2ffeffd81c99b19d92fdfc79ce6a
  • SHA512 ca3af6ff15ff2eb5fdf2d840b447d19bd280a5ccc177973c5591f42c27c6695afedc9620832b1b45ed76e8fd070e79fb8709b59430fa30863425782e47d142d9
  • SSDEEP 12288:avMFLIKq4sZOt0zYyxMcCvVpwDSy+K/khxfptcVEvLt+UbSz8dyn//vJ4Vm7SLVz:JLIzORtVpwuJK/kTD1K86/vJ4sK7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2