Extracted

Extracted

• • Target

    NEAS.NEAS6cf693bad16af8a716014d5dbf978dcfad1d39c3e079ac383c4bd0870d583c96exeexe_JC.exe

  • Size

    413KB

  • MD5

    a1d640a8696f12bda8457ef6dd4a97cb

  • SHA1

    8eeb3056f47f309ad4406674f697e6ce9218b5af

  • SHA256

    6cf693bad16af8a716014d5dbf978dcfad1d39c3e079ac383c4bd0870d583c96

  • SHA512

    3257662605cdf00e64d6d1d0dedf9b9b7678805d0bfa5a20a5971a333437757f4b629c78df29bf0f25f486031eed9f703736cdf4393e2462f44c97c2b320458e

  • SSDEEP

    6144:Jf8zGBIKD2SJMzodRpUZNFvzsB8TPCUnEi38UIRZdk6ceh9X3P9lRc:N8zGfD2S+j5sB8uU21k6ceXm

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2