Extracted

• • Target

    1cdba11094ae2b0b93b98bff9c6714293a14cb61bbe21a5a851a08d6e89507ce.exe

  • Size

    644KB

  • MD5

    c6831026773fa273685bd3b584d18e6a

  • SHA1

    5e10090f47262a60fe3c0d2da9cf45d63bf2bf29

  • SHA256

    1cdba11094ae2b0b93b98bff9c6714293a14cb61bbe21a5a851a08d6e89507ce

  • SHA512

    82d74e72bf7e46fa529fcaac3f546bace51808f38cfc864712bc35c826388c0ea6e445f6aa33f917fa3cd0cf33dff814e5f80047a5e82b8027301bfe96537b2c

  • SSDEEP

    12288:HPkiCBMR3tzaiJmgMK8nINpJ1voXE58rWc44wkOnnehXixdn2OJLR2W9XjE1rH1Y:8irtzazvGfvoXEoWMGnezOT

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2