Extracted

• • Target

    7bfacddb1871cc1aab46c0274e8e8f2cfc2cbb4b7caef9df24b6933a1ff75124_JC.exe

  • Size

    1.0MB

  • MD5

    54e6b3143669461f4df675f32705f602

  • SHA1

    779e635d839eecb38aa17b5a89ae7a5549bc7d79

  • SHA256

    7bfacddb1871cc1aab46c0274e8e8f2cfc2cbb4b7caef9df24b6933a1ff75124

  • SHA512

    da327e65a84f0e2c4e19006bf0492d555a4b96d657c8c93e7842ebd6de9d96a47529e9cfd951425ca18543dde7d91e112b7700f978586e438894f05826e1f07f

  • SSDEEP

    12288:sQHCr/cT5J2iNtxIQ/tjwUj4m3r+hQClaHFe8MpZkD8qaCFHi4gIrDRjmfTf4SNv:y41F3904CuFe8MpCwcF6Tp

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2