Extracted

• • Target

    NEAS.NEASNEAS4c076ca3a33549fac8442be24c36aa480b6659e65816aa2a2a0292c1fe7a4a51exeexeexe_JC.exe

  • Size

    404KB

  • MD5

    0510813ffec6988f2259fb1ca510140f

  • SHA1

    22e331320f6a81af1026c9fedf1d974454d9479b

  • SHA256

    4c076ca3a33549fac8442be24c36aa480b6659e65816aa2a2a0292c1fe7a4a51

  • SHA512

    9e9c4f25622a79efd3bae64b044456dae9ab25a811da4379f6c30a561e526a0216e5be4e3c80de7d37dec611d14c66d3a346ab03295446061d0397b629c101dd

  • SSDEEP

    12288:v1cNNUaPs5nNmKRC/QYKpXTAQQ0M4R7VNcdYF+oCHzwap:tX7C/oDAQW4vNcdE+oCTD

  Score

  10^/10

  snakekeyloggercollectionkeyloggerpersistencespywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2