Extracted

• • Target
    f6d66162ef846175f929b3efbdbcadc7.exe
  • Size 798KB
  • SHA256 4a59447d218d3dcb2cd42ee9d9a6b22cbfd4300c5299f91c58d0630ad946de8b
  • MD5 f6d66162ef846175f929b3efbdbcadc7
  • SHA1 1ae626a81c2d58f6a979ea4e815d3db91b2dc0cd
  • SHA512 26df56646c11e3f6031a5a2fe1b370a28574fd36c26b1e31081175f4d13ed3a377bd8223d929ba8d6796b72970e25993ce1e090cc682d70aaf30b70ecb508912
  • SSDEEP 24576:sU4v+pARoX393TYWPIKFL9f6O4ZVCtcu:C+CRe3xddFL9CX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2