Extracted

• • Target
    286d00537d61497e63705dd1a72e416b.exe
  • Size 886KB
  • SHA256 43dcd17aa2e97a45074d166854347fe25b59e384eb84ddc685092c21e1a4db1f
  • MD5 286d00537d61497e63705dd1a72e416b
  • SHA1 deaf7a15d9582edd78bd8e411dc73348d4a9b933
  • SHA512 a5ad5b32f0d58f9fd36f69f2fe3365b6fd21fda971069992613c05d1c966ab886c7c102db5c12541ba9a2dd258a92aea28eab5af8754c971258e8d1e51cc493f
  • SSDEEP 12288:C2o6F25GPtdUAV3rvWnFGNtNK0H+JtSXAtBqhGpY+ZmBjHUk+qJK3o3D1:DT2Yl9V7vKFGNtN3eJEEEh2hZmBH2U1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2