Extracted

• • Target

    1a552b5db668c321e7f584e0f2d379afc41c00707e4fecad232823445bbcf8be_JC.exe

  • Size

    931KB

  • MD5

    8e841cfc7f7abab974f8adbc4e260346

  • SHA1

    385ba1dad2877c6a712cda30dbb4cd47007d93ce

  • SHA256

    1a552b5db668c321e7f584e0f2d379afc41c00707e4fecad232823445bbcf8be

  • SHA512

    ae50615333524c4b3aa89bb790567d3464ec122d5fc494af62c55762c0e522b7a05c2bb024b1bb0a422f4ea22727b0f372d21735475dc93fafe3dada58748691

  • SSDEEP

    24576:IwMf2oD5HOhpMmKHeErwqFSVSd+i92MScNXVbzQn:IBzODMmAeswqIHMtNX2

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2