Extracted

• • Target
    NA_27558e1c43393f99253ade85b_JC.exe
  • Size 145KB
  • SHA256 27558e1c43393f99253ade85b0a8c6a1a3933fa4fe175f744553df42eeb616d5
  • MD5 44579827f8bc295b453fed19d6f7a001
  • SHA1 6cae79a82072060270806c62029c1ee6ab6001c8
  • SHA512 ea4914011e92b7c783132b74dc96b090d7642e05289d55b812b4fdd277f4c806fb76eb65729b44b7d2f24f295c9887fa0b00b73cca0dc822fbda7122bc03f943
  • SSDEEP 3072:AmtcXlsLP0UCzQcNtytbzDobdqwBpHvMQ5pX4o0HwbY:QobtbIdXUspoo0Qb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2