Extracted

• • Target

    NEAS.NEASNEASfffc596389cada3bd1e1d1659029e607e14320cbdd126de7fdbe33b99f9c59d7exeexeexe_JC.exe

  • Size

    533KB

  • MD5

    91b3358aed52598ec71ce12e626c2c11

  • SHA1

    fd0213e5acf681ea21bc829cb8fc6fc701312f56

  • SHA256

    fffc596389cada3bd1e1d1659029e607e14320cbdd126de7fdbe33b99f9c59d7

  • SHA512

    454b46d863c090e56b1475e9958067d29fa972d74dae1b6f0eac0e3ff9abf9fc45af86452b76fd9a1a866c5969c7c97bc009f5f608255657f7b806292fbfc84c

  • SSDEEP

    12288:aZDJ92Igq/oEzwqrAjWOAlvH+OzSgbuu7DR8wOezpo+J902C:I/LnzwqrAjTyvHBzR/IezH

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2