Extracted

• • Target

    0c1ff3575f457ef7b6d78ac620a1be3702c9d4c7bacb4da86bce0314ff799353.exe

  • Size

    1.1MB

  • MD5

    9199911a63caab4cf13fb876ae6e7c97

  • SHA1

    5f7ad84c1b292140f7084930af6d2b5f938efab7

  • SHA256

    0c1ff3575f457ef7b6d78ac620a1be3702c9d4c7bacb4da86bce0314ff799353

  • SHA512

    9b3dc358fe9a0b15b2c5182e41f9fcea71038b0e694204074784d539bd6df8166e8ab96c6ab6eb3330ed31d2ece4a60691ed3c53a7e1d35796727b4a8281dcb0

  • SSDEEP

    24576:VAHnh+eWsN3skA4RV1Hom2KXMmHaNATBvA5:Eh+ZkldoPK8YaNeg

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2