Extracted

• • Target

    113-14-11-23.exe

  • Size

    506KB

  • MD5

    670c97b70fccca905c87e3acdcc65358

  • SHA1

    674d8dc3316e451c4139073ba7fbb6b8692da907

  • SHA256

    dee9635e6bae8f84d02a7a406fa7c898663636ab647681143b288384442eadf3

  • SHA512

    a86a43a6836a64aa6e2fb2d75cc4261c6832b80d0ed8c0672b0becbb6cb4f6ac460004919a4dd7e3a67d08a53ae08ab32d1dd8b865e6683fc7d840e7cf30bfca

  • SSDEEP

    12288:ZVMcthmJZoIF7SITWFl+QKU4NwBwvNUVYZqWhvMVnzsYKttOfIIAFnSE:aoIF7SoktIgxWhDY8tKqS

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2