Extracted

• • Target
    SH098765435678-0987.exe
  • Size 1.4MB
  • SHA256 90dbe727caa8557cb4d67c58b52194324ecb9496d80b33ecf776ee19e650e6fc
  • MD5 47f2f1b7e3158610a93c45b75d7e9e4c
  • SHA1 2905893c10edbb9164b3f7725b591cfbe667b53c
  • SHA512 e96662b2128d35b7d561b50b8b79251805a16a78e5a6eb135ad9a601389ef38a91f671850d9b5fa3dd002c4acd467b1308b95a7595aad6d5ca7cb99e7cfd0ced
  • SSDEEP 12288:T06q1A8H13l0pYHNnOvylleR5hsbMgpRsumFBbF4yoi5fZQuqm2aEArj4gg83E2V:T0p1A8HrnMgpjiEyguoWpjj/5cYOdue
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2