Extracted

Extracted

• • Target

    NEAS.71577df45ab0ca4cf844c77df74cfd8a173cd9cd29c74be653a5d345fefc0a91exe_JC.exe

  • Size

    368KB

  • MD5

    e45b53b4adca836654000e41e1701077

  • SHA1

    845c16b8b75e52393c6ab2b8b02f225b788bd3eb

  • SHA256

    71577df45ab0ca4cf844c77df74cfd8a173cd9cd29c74be653a5d345fefc0a91

  • SHA512

    f2ced1cc7c83251b7ac311614fee5f5a9c0f92fa7d772cc3150622fcbb07d380c72d99a53f69a34b8799e0749e368f50ce9b640d44ecdbb95b2f3bfd221276dc

  • SSDEEP

    6144:RxqOazRkeHLR0ph969tLXDHv9VQvCOMT/eYOtYYE2Odtyqd72fgSA:/qOazNWpefjDP9WvCOMDZlYrOiqo4

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2