Extracted

• • Target
    5d0bbcc25010032999e02b657fe402ac.exe
  • Size 753KB
  • SHA256 8fdd895977065b5248f16aded86e5128fe208b5ca2b6ecb858a9e03f2d88bc79
  • MD5 5d0bbcc25010032999e02b657fe402ac
  • SHA1 1fbb8b8084ba09d3003a0d8c8de486a02285c539
  • SHA512 58fad19d18aa6099ab0267682d330dd9dcdb74e45a10351020b894d471fe33de295c4252f3a8c7517038e6d0c2b2d5a46222152dbd810b482f8970692fb5b5fd
  • SSDEEP 12288:kA55B0O2JhZQ4n0AsnaCoqkYWnSBHmuVWvX41ep+xxk4:kA5j2DQ4n0AgRkYjG804QJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2