Extracted

• • Target

    9a7327bc3799fc8420f0d19a66a9c7eb.exe

  • Size

    595KB

  • MD5

    9a7327bc3799fc8420f0d19a66a9c7eb

  • SHA1

    92a317bcdbfa15952ce12ff845a0c29e5c5f7253

  • SHA256

    cf2f199d38249385e795d2adf81b25ef32d481a1ca0621f2dfaa62ba77ed9a52

  • SHA512

    1b021e794f9fedc1d050017ec7b62bfc52f1c310ba19c70d81c3b93a8757dd67251ef4e23b5dff3a86e81d29dfe073d3f5a80ecd9a606cf97d4809576e860311

  • SSDEEP

    12288:o6wO2l2xtAqQXiMCPvM6bOPbVKlUwNOcC5UcLJ1EX:1i2nAq2iMK9EBlwUcC5Uk1y

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2