Extracted

• • Target

    TF-24098-001.exe

  • Size

    509KB

  • MD5

    15263e7a37292fe57209c7f3c1573d55

  • SHA1

    f66db7efb5fa5fbdf4d0ed2397d9064f5de20e62

  • SHA256

    f0a380fdc3f7682a1496a867b4506c2c6258db3a13c876625032483e4d872f1c

  • SHA512

    3d8d65dfa2f293f00184112ddca0198938817a8a6bedcba088c067e31bc0a2814d3302087851f2ee0382570190c5623e6451c506f8eb5b2d62da27d19d68e6d0

  • SSDEEP

    12288:GuPiP54ahSfBTMIRGRt4W75UrruAgERNG4IpC2:RM4B4HyWI6tERJj

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2