Extracted

• • Target
    1f7a0cd77c82909f4e894b530b1421db.exe
  • Size 829KB
  • SHA256 6d07ef231c728f37b5c8b04440d7329cab83cd2193edc13b9077b6dc73a3c272
  • MD5 1f7a0cd77c82909f4e894b530b1421db
  • SHA1 be58ac3269daf738314034d9b1c52f3598dec480
  • SHA512 ee5ad636ac4270388498e1bf13d7fdcdfa99481ca743c10d6745197be45e8341a3aa5c6dc982ccdfa1751ff12e265bf52b843d70b9fa3badd28bbae4d61f3e9a
  • SSDEEP 12288:ToQgKZ/nXt7virmWhlGLaQYI5iHpJXjCNva9100c0Cs6Mio5/MQsfnwE7QggRJ05:/iPXjCNw0nNshJMQabUggRJ0go42
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerkeyloggerstealercollectionspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2