Extracted

• • Target
    317dd7f30dbe83a609f0c282887af0fc.exe
  • Size 917KB
  • SHA256 0f467217bcccaa0eb494cb5da8e328cf5d16639ff4dc5d0cf56df96895f19a38
  • MD5 317dd7f30dbe83a609f0c282887af0fc
  • SHA1 99a4d529c48856ab4f436f09731086eee56fa7f8
  • SHA512 d8c97a7631cd5621d551d827a7f223a2bee59287783bbc26e4dc0fa26dc07a7ff70254a3f90786810fbce8cc9a805ea3b5bf9f69d295be63b6f9ba12a89c769f
  • SSDEEP 24576:Y1bgzPGhgzfYrwMYe1PUjt65AIpU2IPteL7ycA3:YZyPyywrwMYeu45bpBQteyr3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2