Extracted

• • Target

    e8d481924c090333dd7e0c1f9b3eca1711bbc3317796f8b30a5d29dab64aaee3.exe

  • Size

    463KB

  • MD5

    9987897aaaaf01d04b9377723f1fdd1d

  • SHA1

    8cfc69dae7ce0421f183b40573a3060797687bff

  • SHA256

    e8d481924c090333dd7e0c1f9b3eca1711bbc3317796f8b30a5d29dab64aaee3

  • SHA512

    12b6966c45c9aeb3b7486ae969d4c5e0c56dcf3fa48cb9a772ddcf1666f759e8cb9eb498484d5910c17c2bcb616d838fbf877eece8a08ffff0a8dc49bdca9941

  • SSDEEP

    12288:3CXF+TAHqAZJgp+8uwIeuWtaGAxpmkUt5aCOgRFdXg70WhEDAAAAAAAAAAAAAAAM:3qF+TAHqAopTuBkaLHmkUXPdLgYiEDA0

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables with potential process hoocking

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2