Extracted

• • Target
    3ca1a9ee70e56cd13b3472f4263f9c480d5fa9d70a18335e28ea41b5bb048461.exe
  • Size 625KB
  • SHA256 3ca1a9ee70e56cd13b3472f4263f9c480d5fa9d70a18335e28ea41b5bb048461
  • MD5 20ff1f07155a24c9b7f8b444ea58255f
  • SHA1 7258dbc04af293dc048e9ad6ee4669a89a7f85bb
  • SHA512 2311368f28dd28840316e82139367f85f2f8354281394c42af4cd464baddef08f331cbc9bb0681c169780a4bae949214f4a73ec4d5db5bf35ec9d071fbc46193
  • SSDEEP 12288:4GM/cQggfXfJndIbSO0kTg8z6N21563LDAjBDhGyYvTav3imOMt+D:4H5ftdSSOxg8z62154Au7av3imX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2