Extracted

• • Target
    e-dekont.exe
  • Size 1.5MB
  • SHA256 fde971f3c35d3955e58bbad12e7f55ec37a1655afed1af842d4eb5d32a6b4cc4
  • MD5 ff55bf6131e55371e4f2eaf23cfb1b47
  • SHA1 a86b984ae1a83ee405ebba898981c839d3651406
  • SHA512 e2643f4540dd671c34ef7b7958bb1ace591bbeab4d9616d0b730e8a74eef53f9e421df5f6161f10ee58cf9df90ec7977c0a2b854a055d793af18c94d510d032f
  • SSDEEP 24576:t/EH+v/D7SzY2JdDpPTFaPoBwMDWLMduTNFxbCA6/+otq:L/3SzYcdDphaPoBLSLxTNFha+3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2