Extracted

• • Target
    SecuriteInfo.com.Trojan.Olock.1.25940.17118.exe
  • Size 704KB
  • SHA256 bbeb2bc4ebccbf94ad87dd8f650d4b9e2b9dc65b0fe9e785a44a4f8e464b575e
  • MD5 4324ea69e5ea45c825b3f851f762514f
  • SHA1 92321e98305af200088d2c2fb8cb1e814f4bcd6a
  • SHA512 8388eefbec7694a53b3fb61e40851656f2a37cc1dcac890370924796a7513f678a7ee97c286b1e16febc019a406d35a8fa6c8f8f1b11e698fc84334d2d508d63
  • SSDEEP 12288:0KIO7w4qE4iVV/r7VWCqS1Jc0qLXTIqyROZZ768j8gfzGY3:xIONqEZV/NWCX8fEqKOv7Kgfz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionevasionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2