Extracted

• • Target

    c91949910f477e57ea7f4e38b81f98dee405da84502dabdd39ff9bc621db5df9.exe

  • Size

    1.0MB

  • MD5

    89761f3fa995c9344721da2f4ba79ff5

  • SHA1

    4b310755f57dc212cc9739511c15e89f44cf7a14

  • SHA256

    c91949910f477e57ea7f4e38b81f98dee405da84502dabdd39ff9bc621db5df9

  • SHA512

    a119adde67a547ee086a9a3570f9833b8fa75bac7874e82bf34f78e29255ce654a6e45105b7323885cfe6cfed6781c039cda24eb052051abd58fb34ab9b52253

  • SSDEEP

    12288:zhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcbNPCV68Lua13KVsrOQW60ZtV:5RmJkcoQricOIQxiZY1WNPk2F2rBjmB3

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables with potential process hoocking

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2