Extracted

• • Target

    73369fb5dd9094797decd0bd63f6460ccd651b242eaeecc183d5a27656b8a486.exe

  • Size

    1.0MB

  • MD5

    ccdce3456142bfcd5408675b3f229ee8

  • SHA1

    81441a9fec1c88448a452391f7f0a7fa2056974d

  • SHA256

    73369fb5dd9094797decd0bd63f6460ccd651b242eaeecc183d5a27656b8a486

  • SHA512

    9d9ee51f4b0e358c82367ee56d1bcad8c5e4dff4ba2f2911e138e1318347b75dec65f7c1877895a07057e0f00047d06b8c486b05f328761901dc433c5f60ea8c

  • SSDEEP

    24576:vqDEvCTbMWu7rQYlBQcBiT6rprG8aMKP6Q/hH:vTvC/MTQYxsWR7aMKPp

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2