Extracted

• • Target

    NEAS.9effb24088b93de7e99f6e33a9e81b4d7bef01720107e634b98c2774fd913744.exe

  • Size

    524KB

  • MD5

    85443ccfa143379ec25bb88f633b52f9

  • SHA1

    54d38cb1493d74f5db941457134dab70e6adba6c

  • SHA256

    9effb24088b93de7e99f6e33a9e81b4d7bef01720107e634b98c2774fd913744

  • SHA512

    74d7b2a19a979ebe7c77e1408f38e2be17c14dc3cf58e558d97f2e870eeb2ac552deb85f591e0d78bc672a75f475919545a06d68f31f11455709d5cc8a826926

  • SSDEEP

    12288:GyEYyVFliq4zzbTA23nSbFHGyWFhhassVGaW90QDZmcI+vy:nV+FliBb73nSbFIKsskF0QkcVK

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2