Extracted

• • Target

    NEAS.d408028effc2b11fa534f39e69c131a8342d1a8d40c42cadb0c4c019c3469b5cexe_JC.exe

  • Size

    717KB

  • MD5

    7de3603c105f2b4d2f6b597f0ea13c26

  • SHA1

    7b68dc91cf9417b7a1bee1c09f7ce6f607d38dc6

  • SHA256

    d408028effc2b11fa534f39e69c131a8342d1a8d40c42cadb0c4c019c3469b5c

  • SHA512

    fe2400a2342a736b7c11d8dca169f0bcce32a63ff66a8b953983556248d8e526faeab59cc794981b1ebaf4c7bfdb5382455963bcfa258f9dddf7645c5e14088b

  • SSDEEP

    12288:32srGElHwmoTw5S87l5Rew+yjVeTyoEaIoqTIYJ3vTMNy37:frPHwHcz7l5z08aI9TxT1

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2