Extracted

• • Target
    7b510a26d387227f8558a7b05bdb4795.exe
  • Size 2.3MB
  • SHA256 e99086181ac130803fd5f3443f5485ecb3de67acd2f129f888e6ce1b8a2da20a
  • MD5 7b510a26d387227f8558a7b05bdb4795
  • SHA1 a5604cd78ad136b78d9393a551da861f5f77cd9b
  • SHA512 b2acd9553582df81b27f8fc82091111d3c5108aafc39e433c1bbe2d383beed1a992d59e1c3437affdc14ca28fceed6d829fa781e584baa1598e4abfb49c62079
  • SSDEEP 49152:Q59zMNe/Okm8bI3wLYz1tZD1V5NQSrBnbx:+zyaOIbfiZD1V5Nftbx
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2