Extracted

• • Target
    8ee90a49d860205395973a7810661081a76a3a120962375e6a67d39a1e669429_payload.exe
  • Size 130KB
  • SHA256 4ecf58f56c8a8bcee9ac95a7b0d8b3012fd8319d309461cf4c3109de97f14e2c
  • MD5 890fba706b35885aba8f2f41b9216de3
  • SHA1 6b37773568f6a535662e05a9814dea36fed24ea6
  • SHA512 d7f46840ca96009fa468cc0ef24cb0dd8f8d06d9b3afee88dae88c5cd602bef29155af3d1b2037946c7d4af375aef248b71ed80298f21283af02af4a6311c5db
  • SSDEEP 3072:s99yINAgKjV545jbvk5Hbe7fMuJN07TwNumqoywlK6MPb5Z7mWxwvcXmogbY:3INAgKjV5Cjbvk5Hbe7fMuJN07TQ/Kxs
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2