Extracted

• • Target
    e224c8372b3b03fb3911737b5f80999c.exe
  • Size 598KB
  • SHA256 dd39b4b8ed5092bfd590f6a175d78a59ffebbafeee05b47d909b9321ac336d46
  • MD5 e224c8372b3b03fb3911737b5f80999c
  • SHA1 18d8efe96b522acc76755f646cf50762a05add3e
  • SHA512 b0d94e2f3c8791b9f596b1e7d1ae7517f54270f30989b4527b059b76602f65c0e288cf905f0f0f1f6ae62faf74dc27caa19bbe10fb22df41044a74c4852b6a6a
  • SSDEEP 6144:CYa68uelAA0I4YB5FtyWshzDnJ8Mj3NM25vixdyVwXHkFyDh:CYCLOIh5FAjMsvie8HkFyDh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2