Extracted

• • Target

    3aaafc1f45beb62bc32bf916a472a3f5.exe

  • Size

    488KB

  • MD5

    3aaafc1f45beb62bc32bf916a472a3f5

  • SHA1

    43d045c1eee08363ba6b3a417f29d099091fd82f

  • SHA256

    985dd3f7e6155348ccb6d8e7d00bd79e1ed45524556e5e93c4f34145668f9bf5

  • SHA512

    e8dd224f4a760985ff2db2eb39908c0dc1b2260fb698adb00acf3ec9e5c2e8d641d2eeff17d31312adfae4e8648b194c32558456711b57b4faae23d802d7dd11

  • SSDEEP

    6144:UoBIKsvvklriDeOZk/iKUYYpQ4Xw9sn6b5SD+8xl+K+KUD7bXKtJqSEzWsSE/e94:zaKsD6/iIYpQ4Ak6ljrD7bX+UwqW9jq

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2