Extracted

• • Target

    SecuriteInfo.com.W32.MSIL_Agent.FPI.gen.Eldorado.14269.8068

  • Size

    610KB

  • MD5

    77b7f764bde4a8e21a6e33ad9ef4af4b

  • SHA1

    4980100791fedd970187418ff5d021cdedf0443d

  • SHA256

    53ea1826e53406dcc0d0da1fccff25c5beb9deb6065cf554303aec609209bceb

  • SHA512

    46ec958c0bb054cdd9e98199499d69427df9d15a65908976271a7feba20e7f956c65ce40f9136992a03875d47b9f86c8b5dd089c7a963ba44573dc613221b2c7

  • SSDEEP

    12288:1Gezd7BR6wTsP5/ZFQdnkTyYITpDaFUUybAXnUWmz2f5Dfr:1GezpByvbvkWd

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2