Extracted

• • Target

    b5d65c04a01dd0fe41a85f37d2e221651def9ebff8d315631dfaa48d40afd210.exe

  • Size

    515KB

  • MD5

    6d482d6979ff13a56f0dd2223237c40c

  • SHA1

    627f46fcb0452340b74908696c8ad334097fd4a2

  • SHA256

    b5d65c04a01dd0fe41a85f37d2e221651def9ebff8d315631dfaa48d40afd210

  • SHA512

    ac2a5e933ed57a353bce661ab55244010541b60384846c8dcb209c1d4aec95a1ad4264788ce5ef42be5c8ff62938bdbd96c1e9fad89ef5e7b53da28cc8de1c3c

  • SSDEEP

    12288:WidzH/9cHIwNt4tdLk5guhUehzeBRtbXCbXZAInv0wMrxlYu8F1nQPD0RfvE5q:WumNytdLkAHyzZPnclrTYVnR05q

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2