Extracted

• • Target

    bd38a5ec8fe7f50647e8d16d119058656f5099d99ef1713081add04dcea453fa_JC.exe

  • Size

    348KB

  • MD5

    7f4fdfffcbccb427dcdad0bdf96b0a17

  • SHA1

    4111b148181f8d0a9d847f9ba0a6838b79e6f9b5

  • SHA256

    bd38a5ec8fe7f50647e8d16d119058656f5099d99ef1713081add04dcea453fa

  • SHA512

    8fba5cd6f9851e98320d8ecb3ba008c10135c5d4c63f89403b45775cbcd0484d708cd9bc086aef77319e58126a427a98842dbc4d4a9b1d21656dcc07c3b73023

  • SSDEEP

    6144:vr9BIKD2SJMzodRpUZNFvzhwH5v/y+uwWRpZMc/b03KdeRV+9dk6ceh9X3P9:BfD2S+j5h0vRLGk6ceX

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2