Extracted

• • Target

    NEAS.701d2231e9b9297450abddc537bfdb90fbb45f679b6da2e1e45b615280bd95c6exe_JC.exe

  • Size

    437KB

  • MD5

    3e872d74cb692deb202d25859986357d

  • SHA1

    9ba324ec9ff4f454409f653da5d4d7b694255d6b

  • SHA256

    701d2231e9b9297450abddc537bfdb90fbb45f679b6da2e1e45b615280bd95c6

  • SHA512

    90b800106b029cd671216a0566a573975a6ed3bcfd45c255f47b4e8f9766674f01e3548b5f0abce53258ec89885f8bcd04bc9c85a97596152cadcc2b361e86dd

  • SSDEEP

    12288:AD7gUiVaOazGypq9Q/NGbEPAj6JYrOiqot2:daOazTNYE4j6c

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2