Extracted

• • Target
    61d31218fbba6d9c54870e092250bb84.exe
  • Size 743KB
  • SHA256 03372b5bc8f3150c3698ebb6f356c11ffec8e23961e8d32b0c7ccb4ee5742636
  • MD5 61d31218fbba6d9c54870e092250bb84
  • SHA1 cca19b675a2341382754a84a69751d6da6e8f707
  • SHA512 22ebefc84f80e46b93bdfbea24e1324af68413a5798bdb54710ccd2a7085243b5f5f5081d3c2d68746e5a5a7ffb16d79f72c795ed9fa542fc831445fc59fb0ce
  • SSDEEP 12288:bFhCRqDSuMDsv9teBws48tPSVycPflIwKr2Vji5ElK1Ax7r1PmDsv9tLoiM+KFie:bFkqDSuOB48tQycP9IwKKN0SXX19g
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2