Extracted

• • Target
    2fb6b42dc62e891e686c9a8310cf0201230fa40cabdc6a47f6cf3014431efced.exe
  • Size 1.0MB
  • SHA256 2fb6b42dc62e891e686c9a8310cf0201230fa40cabdc6a47f6cf3014431efced
  • MD5 b1fcc91eac7370164a9c11fbc8d0aaca
  • SHA1 5c5ad57c33b6455f006381c688731d25355c0c19
  • SHA512 999ce5c3606c29920b08b917cd6684fd354cd5728046909f5101674d7349c2057fb6e3c80afa208dc36eb795234362ea5c1e7a7ad137122d1dc201c183b1360f
  • SSDEEP 24576:y4lavt0LkLL9IMixoEgeajB2YKr1pDnUqc/2H+oq9MmCS:lkwkn9IMHeajB1Kr15UqcuH/aPCS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables with potential process hoocking

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2