Extracted

• • Target
    f690d5bc6a912808ec7c3cde8a7f88c8.exe
  • Size 919KB
  • SHA256 03a2024571a99c0e24be3ab024a9869b41d0e60e52db34d5bab311cb4782c7b6
  • MD5 f690d5bc6a912808ec7c3cde8a7f88c8
  • SHA1 4342133a94b3dab0fe87eeb9b5024183588134d0
  • SHA512 f7c20fd1e2366e701a5cbbc02a70a412857f100fd1f82174ab538639e3939e5004a014e53ccf7cd90e4fdbe7209321ed69046eda656d7207bb2a2eeecf215b32
  • SSDEEP 24576:1ky9IISOJ+HlvTrE9TLzhYczfeTIO0JEvp:QC/DrAlsEv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2