Extracted

• • Target
    76f9c8f207f595c256dcbd6f3d26b373.exe
  • Size 604KB
  • SHA256 ef96aff361fcc5b8c1efb69dcd5c68ec6956287f083c73ece05bf7afe86673de
  • MD5 76f9c8f207f595c256dcbd6f3d26b373
  • SHA1 058c6cc660b1ca388e54a951ac88e6f20bde8c09
  • SHA512 e8b28ef0ca69b9354388a3e7eb6689125a6c6318d9c7abac4d766ae961d0202dab06e751d4061a28c710aee8676b110f3bc90a27af7f4e21d3b1180fc798bf9d
  • SSDEEP 12288:9sC66Bm2iNNwxg9LoAuO0IJ/VF8dKVEOVqP+TnGYX0V+66B:HVM1rwxgZoAx7Q8Ois+M+V
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2