Extracted

• • Target

    Scan00048585.exe

  • Size

    1.1MB

  • MD5

    5be407b01ad4de50559bfbf8dc3f7e98

  • SHA1

    25a24f3c27667ba56cf44f7ba92891db7bbfa346

  • SHA256

    11f2c66ee3a9d2a70ee4267d5db17444d6e825b29edba999acaf8a1dd2908948

  • SHA512

    66c855a50e0ea7935e600b01b292d0b3e43800a2e4f20bc83c0191ed4ed56df4f07c9970ef9d4f7c98835795cc5341ec3f42ac97877cc1a526e55bb459488949

  • SSDEEP

    24576:CqDEvCTbMWu7rQYlBQcBiT6rprG8aPimvY2Nnp5N:CTvC/MTQYxsWR7aPrYS

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3