Extracted

• • Target

    NEAS.b0b23fc04103747a567f6233dfaee3bc9405ec84550ace32acfcd66a57d104ea.exe

  • Size

    367KB

  • MD5

    1e6ef4467d814dc8ef08e1ba7bf679d8

  • SHA1

    f68db8dafc9af7777f879f3f6e64ea598b750fb9

  • SHA256

    b0b23fc04103747a567f6233dfaee3bc9405ec84550ace32acfcd66a57d104ea

  • SHA512

    2355aa0fd4c1e3fc2f3f11592e9ee58f893e4acfd8205d5542fa5da5c79bd4e9b70e261828a8210bfd972117d4c9200fdab5cbb6e1730f1abae24c94e6067ad5

  • SSDEEP

    6144:yAY8QgjL2G3BjVEOFOFAbApunj+whXQ8kSU7h9NBoRM8Xaqegmc8KCx74L:B73wFAbApCj+cESM0M8X0xc8KykL

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2