Extracted

• • Target

    zV75lTXPGhSIuFY.exe

  • Size

    681KB

  • MD5

    5e3e17fdf1f4da26cf38aa79b3bdae04

  • SHA1

    da24d1115793c155956f9c06c7bd54143fc49f5a

  • SHA256

    62ca4586ac29248b3157be211125dc47a83a64cb23ceaab4bf50d0767baa6fbe

  • SHA512

    7906bcf13e209cb38837cf9cd254455ff8f6e76a60c2d4d146a085d4e2bbbdb1e17ec876bb171be9d9bc4dd711c873d24381c30372c7dd16147a77e924e05432

  • SSDEEP

    12288:TeDonSyWeh3ih9HXeipFQahcvGr7tv7g4IG3Gmv6aKJfsHA:TWonDBYTOiAaqU7nGMpwfJ

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2