Extracted

• • Target

    483d3db33740a19cf3e53acd5a0b50e223121c6828553d14449a6dc12497e894.exe

  • Size

    367KB

  • MD5

    7d35dcb3b0fbd2ac5df7fa3bd140d5ed

  • SHA1

    a7976420e477172042cd97c7e717b6fe793e9e9a

  • SHA256

    483d3db33740a19cf3e53acd5a0b50e223121c6828553d14449a6dc12497e894

  • SHA512

    a73434f71723cef7b88430d824d50d742861dc9afde4ee4eb5d9aa1075a2dd8310c112a54921cc34c69caedde51937fae4d0415dbfe3838922cd6f143d9c0b74

  • SSDEEP

    6144:yAY8QgjLaR06z1RI5HiZB/vgiEIogkzeXk0uEGpJSVwaPZP8sqgds8wJdbrrhLPl:BaR06z1RI5HgdEgkzeXkWusDdsIDvywi

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2