Extracted

Extracted

• • Target

    NEAS.cdac9bc5fd2a4de255e4256bdc0a4f5a2869c6849f71c3904c25b71e6dfac52dexe_JC.exe

  • Size

    560KB

  • MD5

    7ec6ec001094450070a36a8a0ff1693d

  • SHA1

    3886efa46208974cf4f84f28fe365c16fdb4edf7

  • SHA256

    cdac9bc5fd2a4de255e4256bdc0a4f5a2869c6849f71c3904c25b71e6dfac52d

  • SHA512

    73ae7eba7e46e8dea6cf5fafe7743dbe6bb9e2cbb758e4fa97657ede20a0fa0071c44a8bd8efb61e49cd9e1c68afac3c0feb79d7d364c49ebce56afd3536b7c5

  • SSDEEP

    12288:BhNh6sxTA6qNhnRUfPhb18/UEXdJ0/48ECRre5Hx5:BDDxs6gFRw1l0f/YreZx5

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2