Extracted

• • Target
    c4b42227d195c3bc6a36bf0e2e1b76b6.exe
  • Size 662KB
  • SHA256 5bbeb09102c0876fc3d18a31c5aefdfc6f42a4354422611bfefedba2d51da208
  • MD5 c4b42227d195c3bc6a36bf0e2e1b76b6
  • SHA1 9b55771236ca4a5d56b0ea166225ac4f7fa8eae3
  • SHA512 c5147e8ea017ef8587e7736d1ab64b9adc3e580519f4b8d88b5728436e514e9b38a9a61fa3ec2c82394820ef9b13e250da9c16c7898994749795a49fbdf3b99b
  • SSDEEP 12288:8K8MtEwcU3gZ+GQzjkATGdsat8o12i+VThOxja80f8x3AmOar:8F6AAgZbQzlGVvlIhO9Wkx3AmOU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2