Extracted

• • Target
    62df71d0bae729795227435a055a649583d55ce89cd8d3198cdc88752bcd4080.exe
  • Size 432KB
  • SHA256 62df71d0bae729795227435a055a649583d55ce89cd8d3198cdc88752bcd4080
  • MD5 ca73648d0c2471ad0d676552f4eba332
  • SHA1 48ae226966a3cb4205aa1e6641f1f9c95914b0f1
  • SHA512 498ec6446802c25a2d1771cc19c5cd85bc6e5992f72c9829585908970343e0c6ed72fe52b4a33437246404e050b7429798266c8155267bad76090f4767c37107
  • SSDEEP 6144:HGGQjGAv+u8hceBIsto732G4X85R8f134MWZb5wyJfBPSOQWZ4v8vXDSJDRa4S2:mGQjGsIcfstoWix5JPSOQWZ4v8PQ7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables with potential process hoocking

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2