Extracted

• • Target
    9a7327bc3799fc8420f0d19a66a9c7eb.exe
  • Size 595KB
  • SHA256 cf2f199d38249385e795d2adf81b25ef32d481a1ca0621f2dfaa62ba77ed9a52
  • MD5 9a7327bc3799fc8420f0d19a66a9c7eb
  • SHA1 92a317bcdbfa15952ce12ff845a0c29e5c5f7253
  • SHA512 1b021e794f9fedc1d050017ec7b62bfc52f1c310ba19c70d81c3b93a8757dd67251ef4e23b5dff3a86e81d29dfe073d3f5a80ecd9a606cf97d4809576e860311
  • SSDEEP 12288:o6wO2l2xtAqQXiMCPvM6bOPbVKlUwNOcC5UcLJ1EX:1i2nAq2iMK9EBlwUcC5Uk1y
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2