Extracted

• • Target
    18bbf9ffed3d017ce656b2c4d9f6c05a7e3b5b4f1b59dd7d38faa954936907e0.exe
  • Size 432KB
  • SHA256 18bbf9ffed3d017ce656b2c4d9f6c05a7e3b5b4f1b59dd7d38faa954936907e0
  • MD5 f25099b1c98d66fe5688f742f8cf8d46
  • SHA1 f152e4542b894d5f9398cf712b440564692264d4
  • SHA512 206f284897a0f88e8dce352720e10f4c27b220d538b970f3af5b29005b6d5dfdcda1215a2554d6146c6a9195b1a7287de77537cb32b28a39aea6c3db9c5fddcd
  • SSDEEP 12288:mGQjWFurkL/MUmHPbmgymy7lP0isnBA1Q7:95FurYmvCgymy7lcisnBA1Q
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables with potential process hoocking

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2