Extracted

• • Target
    NO-202327.exe
  • Size 899KB
  • SHA256 36092694a2b80c584ba98d16b112b3202847072d164cdf8fdaab5c7fe2d3680c
  • MD5 a68bb922b70a9c50bf84e65709819b1a
  • SHA1 960b5cbbd5bb6482f743d819cf7c01a7c361153f
  • SHA512 fd3c327b1fbbef14554b18bed070f2b2669cb48f20df67fa3887eb63e3a191ab7db0b865faf5e8c8a85db5645a9aeb53b4f2966bcd8fe4a812a239c199dc8376
  • SSDEEP 6144:gqfGIRkap2/SmVAmSSkZ8yz9IQMAtPfQswQUUcfpHK3yRy7hDLL+9cJ16WrHQahY:NKSaAv5z9IG5Uz1y7pLyM5HQaJY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerkeyloggerstealercollectionspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2