Extracted

• • Target
    57bfcea7679658da748400b3083a5da4.exe
  • Size 731KB
  • SHA256 dfce3d45a141a90bb1dda531b99447c1c8ce99be74c704d888af79f2a444c1d4
  • MD5 57bfcea7679658da748400b3083a5da4
  • SHA1 4633782b2f25f3f9ecfa29a3ef1d1a6333baa0c7
  • SHA512 9e20076e3cbc228fb75c28e3e74ddffa747de7a0fc65a9c95b519138bfd6791c0721441c2ab38bc24f568e3ab674c819804135fa634593351858571081abb1ef
  • SSDEEP 12288:qqpkePALcxjF1Xsim8oAYXH6gEIExuMLsjA3jyxGPfsKcXnyXx6q16ahRZ5G9:9AQF9m84XzP9csjUjy2h1NMS5G9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2