Extracted

• • Target
    7655678987656sk.exe
  • Size 683KB
  • SHA256 8615169ad317d762db6aac611781bbfa7f96e977e3fcf2e5385a952c8b3a3bca
  • MD5 a0240460a569a2e87f0231f83031c929
  • SHA1 27acaaf3529a328380b08678cff025b5285206a0
  • SHA512 e0a6cf843d3bd8e1ab082633f81e74bd15c040401b3520bf52f8662f2b752c7b00db8999cf3d90a921c02518bb05d8d6241ea75ca6faf76be84e83a3ec9945d3
  • SSDEEP 12288:zJ7AMTihh6xhZ6Orz1XBZ5ZjR1OqpZfSEAYnbV/8TP4PZujiGc4q:KMUgh8yJHHjR1LflnbVUEP0jiGc/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2