Extracted

Extracted

• • Target

    NEAS.5af368f158382f62f886bc08d7eddc7c3b947ef6658535a05c5cab24e50cecdeexe_JC.exe

  • Size

    367KB

  • MD5

    a61754746b52b33f7535dbf287e27276

  • SHA1

    9525f35d9e894349f4ecbade7905752aaec0cc8d

  • SHA256

    5af368f158382f62f886bc08d7eddc7c3b947ef6658535a05c5cab24e50cecde

  • SHA512

    814e3d110abe6a0faf1bc4c025c7b3876abffc6f64ba2b5bf510d4c9fab3c138181069dd7673bd7a4603f66a7fca8e61ccccc0279ec3debdb3ab0452ff0c997d

  • SSDEEP

    6144:RckOazRkzyPtvhW+m9VgbiNFeYOtYYE2Odtyqd72fOsA:WkOaz/Ptk+GVgwZlYrOiqoo

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2