Extracted

• • Target

    110223.exe

  • Size

    349KB

  • MD5

    0f3e1e309ee9dae28670d40e495566c1

  • SHA1

    869988a2a32e1d83425fcf4b9ccc946368ac4768

  • SHA256

    0dc8b4659b84d8d9b96e544279da980b36301253912a043b5e48c9bd7bb6e09f

  • SHA512

    e25017d98af6bd527d200fcc5b0077c33b6610cfecbff68312abba21b0e0ab3dea208dd37de73705ba3210bf76cc1fd4148c943e9a64bbc05b16b8a099ff6dd9

  • SSDEEP

    6144:t7s78K51VhaZ0zc9in+ZExwHNnIjKlMstZvF9w8kZelBs27dU:i8mhaqzkcxW0KmsXtTgelBs27m

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2