Extracted

• • Target
    4e374c62ed1e78170c77da0ee9eed66c.exe
  • Size 794KB
  • SHA256 5ea5baa76e56e7f96fc470ff3b0a6d9b3ba0d0460b2228ab334e0048de21fe90
  • MD5 4e374c62ed1e78170c77da0ee9eed66c
  • SHA1 4744ef13f23a979cfb57b76adda814f655a6f355
  • SHA512 bb7b51b050723f8dbbe34f97f2f21e22b3f0e1503004d4334d36e1b67e622bd2325dc4578c1a5bdc2385819f9b05c1c7c6037ceaaa0b5546e39ea2ae0ff2c41e
  • SSDEEP 12288:CdMe2iNju64akA5I/fD8cM9StuAH8mbDFF9bvx2cHss/S+P:CWe1VuM9I/fDFMM4AcWPbvx2cHs6Sq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2