Extracted

• • Target
    3e8abea82786b2611c3dde68089c20f9cd37dc84da3d0b97a3b3d500aa287ee2.exe
  • Size 629KB
  • SHA256 3e8abea82786b2611c3dde68089c20f9cd37dc84da3d0b97a3b3d500aa287ee2
  • MD5 88d3f67199557dec8286d774bd7457db
  • SHA1 a5391b7b7e6a08dc9b2b00a29ad20d7b98c38520
  • SHA512 6cbdfda96a288e423fe17bc72ee0ce79bef1a74cbecb86397a35bf18fa5c448248a19a514b785699dbdabc11a50bc44997af49985c956b12ecf2dd2d598c1591
  • SSDEEP 6144:sMm4CCHM4NL26fgvhgZPK8fB8KX8WjhD5ll167BDdq+8wkD:sMwg/NL26fgvhgR5fB8Kpjh5UBDdrkD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2