Extracted

• • Target
    SKM37891098.exe
  • Size 883KB
  • SHA256 886e952321e1eae1a50c426ea8bff0e574d28a33ce33d85613f8cebfc45c7845
  • MD5 5e738510a2034921441427f5af1ed72c
  • SHA1 5bb185b7bd5036d9eafb28770a22d61fef17f3f1
  • SHA512 04d7d1c7715bd33135549cf9e458cfae7ce3cd4a6744037980f4848709e0b82913b77d0ac94b9f33526c2c1af24bc7cf90f58ae74da59e379dd4ea46a5216f74
  • SSDEEP 24576:zIejKNDVB3bMgoucsKg6CH+MYuMW2tS5Sg4ulNKQ:nKNDVBoYcsKVRPtS5N4u
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerkeyloggerstealercollectionspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2