Extracted

• • Target

    Cfoc 00109839.exe

  • Size

    651KB

  • MD5

    6cb10f53add5ee1bfbf0928c9a8412c9

  • SHA1

    32d9db653054f39c4af19d9cb45a092d42abed6b

  • SHA256

    a5daa13bcab440154c01d336ff4a9dbf4ff40ece572ce781557a47641fe01de4

  • SHA512

    b1e3b974ed653abd90b157a2c0045faba107e96e8677b370eb3c8452f04315368bc719a29c827698e1f6206710243a3b38b1faa72e92d7a1694739acc0f00cd5

  • SSDEEP

    12288:hqB6dwaYSON8lSEkw5PjRGJmGDpZS3apK5HjhTI61N7:hq0waqNAewtjRG9pK5HjhTI6X7

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2