Extracted

• • Target
    SD987654567898765678Y.exe
  • Size 294KB
  • SHA256 c591ec47c2b8daa5036cb079a83f61d1e02bb9bb340723d3e6b9290f80e5f64f
  • MD5 137df60a4c3a233d3ef5e260deba4217
  • SHA1 93ee87a2ddeb63c2071773425810753c98492ac4
  • SHA512 b9c4b723432c7a38b1fc2b1b36161a375c5e8e27681695dc5e57e5e92718ec38fb6bbab63f237383b23016d97c66fb1cadcfab90646702e137cc41f267da53d0
  • SSDEEP 6144:pYa6wXsS9JX4JB9ddYhKfvfAnXHqdQfJqIST5xpMl+e+k7q/c:pYCsSMBssfvonXHqwKxGl+e+k7qk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2