Extracted

Extracted

• • Target

    9fc2770fbd67c9b6f9f244ac6ac0fa8810c3d50e08c7d77b332bf1447ab77fab.exe

  • Size

    506KB

  • MD5

    4a14a9dedd4dfe259949539090ccc9fe

  • SHA1

    31d7fe0d77ef9b7d3df2f1a2865c3823b116991e

  • SHA256

    9fc2770fbd67c9b6f9f244ac6ac0fa8810c3d50e08c7d77b332bf1447ab77fab

  • SHA512

    87a4f19ce0391e07cf44a90476e180e1d0d7593f760044cc1a264a4d633f458b5d4965acbfceae692936e5263af396b8293644cc17fed97b379a2eb716333210

  • SSDEEP

    12288:Mhfsby3wzyYyVF/W6OTj1JucaNz3ie6m/dzb8B+:PewzyYMfa1JZaVye6Ab8k

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables packed with SmartAssembly

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables with potential process hoocking

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2