Extracted

• • Target

    5a48f0bb8f074090d925bcb6c813ad70N.exe

  • Size

    79KB

  • MD5

    5a48f0bb8f074090d925bcb6c813ad70

  • SHA1

    976d1d14f50d42da98e46214b83c3097b4d1c3af

  • SHA256

    76997337c3512eb4b47cc476e22dc1d0cd861ae58e02cceadeabda61ff4fe2a8

  • SHA512

    6f95d8c4ddbc8ebcbc1f45904e4e132e71c9b045e8aa5ef4673229cc9888274e63bfe1482b7fb9db152497adafeca100a4e04694aa59a1b5efe0d0bb751b943f

  • SSDEEP

    1536:z3NcR35tQ9VuUyvP6kGtREk+dONComoiJ//me:zNcztbHP6DtRWeCRom//B

  Score

  10^/10

  discoverypersistencesnakekeyloggercollectioncredential_accesskeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2