Extracted

• • Target
    INV 88000354.exe
  • Size 701KB
  • SHA256 b2dcddc1c5777df047cd93bfbe626778c4fd4974a6f82f14716c8a27c7f72417
  • MD5 3fe698c910f56305c5ed060dfafbd086
  • SHA1 50d4cd16c88e97fc685ed02c85f7cb299b8d0857
  • SHA512 db344ba4ab820a69ed971dbc9fa4a34063302be9d8a3d27868c0b253e9fd2c922c99e203258af95e1948666c3f71215d66585f5b1dda194fa069d9900049b215
  • SSDEEP 12288:FhvJRBusyNmAhVOh2x84oBHME6aPL8eugyfAIDxXDKO:HFuppOh2RoR4MIDpD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2