Extracted

• • Target

    f02ef41bb5325c5ae2a5923a7dee230d.exe

  • Size

    539KB

  • MD5

    f02ef41bb5325c5ae2a5923a7dee230d

  • SHA1

    ce1a97e9b2d7d708621bad086a311600bbe1e8de

  • SHA256

    4bae43ed39ce2256e4125bbb217fe624635e1fe4e7a9d662be36d15ec3d0d660

  • SHA512

    8b045e3c80944abdb07d45db60a845a269c9abccbe4729248e9f8c4f46499ba7afeb3228dfc7a915999d7a823cd768e04202f0171dbaf5dd192b18ee6f867e8f

  • SSDEEP

    12288:JXJyeB2gCvIb5/9pKd3Hw0MLzSp2q1R4Pd8yU4gyt2r89+zO9Aez:DyY2pol9SNMLO5R4OL4f8pe

  Score

  10^/10

  snakekeyloggerkeyloggerstealercollectionspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2