Extracted

• • Target

    CA0001758617120.exe

  • Size

    836KB

  • MD5

    c2d1a785631c83396916bdd8518816ff

  • SHA1

    dcee076cb2e9aaa1aaa7afa3eb3459f0b416abbf

  • SHA256

    51cd37c383bd65bb2631c9ed4aebb75dca4d84b53192f53039ca3a84068ccab2

  • SHA512

    d4149c5edae9796d714125931a285803ec52a55a00d84a51f74248082dc491d6c3864bf963d3554f4f180a493ca86bf6737fd007f7beabf3bed39a3b173151cf

  • SSDEEP

    6144:ie6MWk/df5/E4ay46AFlKQu4EKOQyCQKw6/zaDqp9/j4OCAqkg9sivaEZTq/YYO:v6aVAjFEKOQFQKwulp9/0jAzgX3hq/Y

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Drops startup file

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2