Extracted

• • Target

    dc5e498d5465b93688dd366c5661cb624456b0982928c3778845b5d640ebf625_JC.exe

  • Size

    466KB

  • MD5

    4d5ce0ea9efcb7e3fdb61c32d1626748

  • SHA1

    5813b82a84f3c3d8f4b5a7af227026fc2c8c7f66

  • SHA256

    dc5e498d5465b93688dd366c5661cb624456b0982928c3778845b5d640ebf625

  • SHA512

    9739f69426a5c58aca0c4349a65417994376fd436c5cd55f2feaf30f8fe15ea80e6271fcd80f0c70f77b1f171324a11d730248429f55b80f842b8a71f2fe7be1

  • SSDEEP

    12288:zMYG3l6sMIBJCx6icVkGYJ/Zi/PBs6lD+S:zjGDFkiPB9lD+S

  Score

  10^/10

  snakekeyloggercollectionevasionkeyloggerpersistencestealertrojan

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2