Extracted

• • Target

    897ccbf6a7b5a8cb1093f151c27c6bef.exe

  • Size

    564KB

  • MD5

    897ccbf6a7b5a8cb1093f151c27c6bef

  • SHA1

    d71cc6aea7a4eddf9f222d33e0ba49e68374d06f

  • SHA256

    95980ae7643efeb9358309c5ec6ae4c61e6d40e651ccf630b038daa144d8532e

  • SHA512

    67048fb1716bd7111d750ac50ec54d92d7874c8dd53d37cb47046389308d6ab83f7a9fce8ca9db68e2a537bb9e122d2fb3ebb373c4c911f26d75039f5c772f38

  • SSDEEP

    12288:R8G1KBsHw0Z9ejsgSGg6vCsvrh1TiazylyzlDFYj2EX53W5UV0prEAmD:BYBuFMCO+4dFYr3W5Uupr

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2