Extracted

• • Target

    07cce5afdb262e566c2f49b305e87949c0e9ffd746ff1ad77aeb103a7e1a0bfa

  • Size

    625KB

  • MD5

    612a4205fcdd9759f9f03bdfc80c2f54

  • SHA1

    c7e6ef456aeed44b7f07afb4532e78f1979cd9b8

  • SHA256

    07cce5afdb262e566c2f49b305e87949c0e9ffd746ff1ad77aeb103a7e1a0bfa

  • SHA512

    0b133a59b69aa03a55737aa7188e673aa79340c27475db84099f9cf3cda5ba574c8fa5acadc7204ebb762ea3cd4ae96842087fa6776529baec4e261ea7b1da1c

  • SSDEEP

    12288:ecCjSCZYM3+YnlaG2Iy6S3K1+QmZJbxpDF:1xCZf3XnlacyL3qV

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1