Extracted

• • Target

    759b8eeb19d732283ec91e12f01836653eb69f384fb2cab4072e67dcac4748ef.exe

  • Size

    1.2MB

  • MD5

    f4c48bbe6cde1a682287a9753ded114c

  • SHA1

    c8fdfaeb6ab3cbb81b4a67e1f42c55c0b9b37ae8

  • SHA256

    759b8eeb19d732283ec91e12f01836653eb69f384fb2cab4072e67dcac4748ef

  • SHA512

    7102455b6983167366e5d8a72c3fcd219312c89ae1eba825014d08d9c18dbdf418b4187f3954957d9497634b30f840420cb7b5a841adcc6561b1fd3ba4e51f55

  • SSDEEP

    24576:QqDEvCTbMWu7rQYlBQcBiT6rprG8aIw7u9tOtIjVnx4Zpsh:QTvC/MTQYxsWR7aI99tOtIjRa

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables with potential process hoocking

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2