Extracted

• • Target

    f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12_JC.exe

  • Size

    542KB

  • MD5

    fb6436801517f4cb1748ba4bf9df2df4

  • SHA1

    2c36e323268892dc7f9987fb5200ee1fb2336df0

  • SHA256

    f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12

  • SHA512

    77140f0e92be4f7b931f33949ef4640b8d02bebcc43e0aec97618eb731efb07acb0648efcc10af630f2440bc2c8fa45b3862b8d77ce5c3f9d908ac9b22bf6977

  • SSDEEP

    12288:5tHparD6dh85k4Y5hLZwi3qjnb7svMufuul8ZxeizmFzx:h4Dqh5LPwi3YnsUufuLnRmH

  Score

  10^/10

  snakekeyloggerkeyloggerstealercollectionspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2