Extracted

• • Target

    376ae58143a7ea2576b707873f9d9c8f67efa1674b33a1f53dde6a1c789c3475.exe

  • Size

    586KB

  • MD5

    b25a99bbeab632b5aef09307b4f6bb8d

  • SHA1

    6d2218e5b6011ea028dc61c54442d071749e7d9c

  • SHA256

    376ae58143a7ea2576b707873f9d9c8f67efa1674b33a1f53dde6a1c789c3475

  • SHA512

    e34ad7cfe288cd7aa9fe6fb14f879f14cb88695cfae7eb316faf08955238bd9404aa2392e26d3a18c89ace0aab50d80429109d2e27693329e20240cc859d3a69

  • SSDEEP

    12288:xR6X9KLdfJq5FvInDAdrzBYng83WTJibCNk:xR6tEtyu0rX8GlMCN

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2