Extracted

• • Target

    6ea20989d66aa35efba273fe6d634b8a7c269c7f03a8df6dcb9c5653dcbba810.exe

  • Size

    580KB

  • MD5

    c3996670eb6356a971f1ae1614a71ee6

  • SHA1

    ef131d2dd9628335ca952fefad451a6ce9f7fa94

  • SHA256

    6ea20989d66aa35efba273fe6d634b8a7c269c7f03a8df6dcb9c5653dcbba810

  • SHA512

    bee62dd3706e3484e55b2b44e9a17474b345c5d391da51edd9789cb0a285b2fd81f0dedfae8e840943693db8b2fea0a36d5c7e1800de0af2439b290b86f711a3

  • SSDEEP

    12288:Vrl1E6jD/Glz9plmQS6HOmfKXS5Cl1b44wvopox:dl1tD/GlBplR7fF5CUe

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2