Extracted

• • Target

    4579986544567SK.exe

  • Size

    222KB

  • MD5

    03583de9c0aab8903f5033c70ec95121

  • SHA1

    24d128bae985a8e0709e4d867510756adbc52d3b

  • SHA256

    21bb03f0edc9d1584da0a469bad83726ed17ce463aa2570d1c2ec74b23d22bcf

  • SHA512

    c603c421ea4fa6c72338b9796b9b19e0452fcc69be82e376ab909e35c2b04e43922b9eedcfcc5eb7b59b5059689f7482f77e98e836400b64f5184d28c1d31b3c

  • SSDEEP

    6144:sQsL+qO8mibCoPxL1GL37oSPs0YJQBfS1apMc4:yO8mPoPxL1GHoStCQBfS1apMc

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2