Extracted

• • Target

    5304e329eb59cd3685412e48275824e7a235f28186493d08935c9db576d6c2a1.exe

  • Size

    447KB

  • MD5

    219d233c4c50db433d953f5f7fdffed5

  • SHA1

    49079a1e8bbba9e82a4ae8e9aaf098ae5691a458

  • SHA256

    5304e329eb59cd3685412e48275824e7a235f28186493d08935c9db576d6c2a1

  • SHA512

    7664b48fe58471fdc36b8a610ccbe4cbddaab0407f892d523686f53ded89e8f864e29938e05121966c1e860b5f40e2193be3c87c8b76c8e74333d0c698e69b70

  • SSDEEP

    12288:mJfD2S+nRXKQV+dHhZdZcZm2TPZHhBak6ceXu0mOFH2m:GbzgRXKm+dHhZdZcZmyEk6Lz

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2