Extracted

• • Target

    df1aac68b1d5b750e188142198dd39eb5e081697a589bbb8641b5840516413cb

  • Size

    519KB

  • MD5

    a638534e1dede250764ef48bc60f2728

  • SHA1

    dedb1aea15b182e35d99e8b75e02f460c6ab5126

  • SHA256

    df1aac68b1d5b750e188142198dd39eb5e081697a589bbb8641b5840516413cb

  • SHA512

    c2358dd4f7ffc17dd28b3d1257a9c5b060e12e471c2b61ef71e20cb4f0b9ae3cdce550b0ffebfd97b48fe0e0c3e18b2bf3aeb28572d4b30ccd7b8d665cfc7191

  • SSDEEP

    12288:o45+po2Zc4O2NGD1wQLKgbX6gAgTvi3ASjgQIFVaUcQ2fy1zs:r+pJZPtoh164snOLamGy1o

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2