Extracted

• • Target

    NO-202327.exe.bin

  • Size

    899KB

  • MD5

    a68bb922b70a9c50bf84e65709819b1a

  • SHA1

    960b5cbbd5bb6482f743d819cf7c01a7c361153f

  • SHA256

    36092694a2b80c584ba98d16b112b3202847072d164cdf8fdaab5c7fe2d3680c

  • SHA512

    fd3c327b1fbbef14554b18bed070f2b2669cb48f20df67fa3887eb63e3a191ab7db0b865faf5e8c8a85db5645a9aeb53b4f2966bcd8fe4a812a239c199dc8376

  • SSDEEP

    6144:gqfGIRkap2/SmVAmSSkZ8yz9IQMAtPfQswQUUcfpHK3yRy7hDLL+9cJ16WrHQahY:NKSaAv5z9IG5Uz1y7pLyM5HQaJY

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2