Extracted

• • Target

    231005-001-ba.exe

  • Size

    17KB

  • MD5

    de27680c97817a80d129bd4296b07aad

  • SHA1

    0a65535b0999203e92a09558e4788fa35ce1356f

  • SHA256

    b0cd061d54e8b33318b34ae93ae6daeb5658e5c7a1af209b48ead04bff0137b7

  • SHA512

    10f2f820b9375452618a9bb6190baef1537203b35ce5ed4c358b7f5b00a9214e15359e200e476368eafa12319728fb0b1233865062d7d804bc41cbd4e1f90748

  • SSDEEP

    192:P2aJAwmOk+4YlpUiCI/BpFNPNZJ9afe3tkBV4:PVXuQUiCI5HNPNZJ9afedAV

  Score

  10^/10

  snakekeyloggercollectionkeyloggerpersistencespywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2