Extracted

• • Target

    42e3d6016d145ae5bd157bd7dbd86963.exe

  • Size

    623KB

  • MD5

    42e3d6016d145ae5bd157bd7dbd86963

  • SHA1

    3728f467ff8026872de04f3ccef78a2d4a47df69

  • SHA256

    48edab5efefe889cc80214488317960772b2482e86a96e1ceac109287926179e

  • SHA512

    6a0bf2673c105de4a69824de63a5a187ff9ce4eb8ab008fe33ddc9a2f3188fcd0ce063a3a8e599f6a3ba8a3f541b88ca0ef57ad57aa95d388fbe1faf1fb3bfdb

  • SSDEEP

    12288:3Vp0K8s6owoQCOahAbQ5hq+JJ8psQA5Uo6Bp83pazn7N3f0SHOy:3Vp0K8s6oworOahAIVJ8SQqUo6Ba3paV

  Score

  10^/10

  snakekeyloggerkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2