Extracted

• • Target

    NEAS.6af326333d060286daaf29227b41f2afb25c43f072571a096c504c84e61749d3exe_JC.exe

  • Size

    853KB

  • MD5

    c1100b4f1a59545b8fa170d3404c6fda

  • SHA1

    3a41caab745f9bead4253b0b44943a6a4979e01f

  • SHA256

    6af326333d060286daaf29227b41f2afb25c43f072571a096c504c84e61749d3

  • SHA512

    53873bb896faed0797ba995b73bbbfa813c3efb754c5da27aa8a9834de2bdf01a7cafd14330a18f21f4484b89ab423ce5720a776533e3026d557b120629ff788

  • SSDEEP

    12288:SNgo/6WgAjGw/7f+3G/PVfv0YuIZrwWU:poyCr7f9PVHxRy

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2