Extracted

• • Target
    99a051064336628ff918ecf63f421510.exe
  • Size 721KB
  • SHA256 20e933700e0a43d79aafad13d07f388775fbc82d732dd00b8eefadaf07b1397f
  • MD5 99a051064336628ff918ecf63f421510
  • SHA1 c96835e278290d42ec7adae42c8a09beccc13fcd
  • SHA512 23ac6ac8eb2841f775e094f71a0fb19b5c008ee87fb2dcc0aa56cf14a8cfc6f4dcf0f867fe6061673caec728856b9121962efe998f0e6a61c451a777233e5bcf
  • SSDEEP 12288:GZQp6r+CVn+f2NOUSTqYZHx4I3emHAl5YkXRIOFIkOrx7p58lCrd4gyQapWMsEP:G68+sxYZ/NAPBGlrxN5IC54TWMHA
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2