Extracted

• • Target

    2259a3953f2af44474abc16d87d444b1776487e5a51dc11f7f49c1e04df68c23_JC.exe

  • Size

    549KB

  • MD5

    2c260000648353220da2b3c5d82ac53e

  • SHA1

    f1833907ce38f01d3090a44fba6a98a1eaa67961

  • SHA256

    2259a3953f2af44474abc16d87d444b1776487e5a51dc11f7f49c1e04df68c23

  • SHA512

    fc53ea4fa7e0faad4f9a34de4d84871b483ba77ef221b0a9187f427fe7f9b3ab73b7263a8bbc050470c34332aecfed525eba2cfc9c2f7df3cd9c3a027bdabcb3

  • SSDEEP

    12288:bneFQNumB0rIbFwaaiqlaITf4DmgDhQSGpJZrTwojI6:afy6IbNITHgDab1jI

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2