Extracted

• • Target

    19db2b3ae98177fe961f6c37484a19e0N

  • Size

    960KB

  • MD5

    19db2b3ae98177fe961f6c37484a19e0

  • SHA1

    300c59f3701777706be62295ea6b0fb2572578d6

  • SHA256

    fff78538dca574199007cc6f4ab1898d10661c36a6df8694e3cb68f17dd24f17

  • SHA512

    f46f0f7c9fbd17b571f772638a31602baf2b0738ca0071e648f6d7d658c0012649d2fefa5eaa25f7a98e19acd0692d729937ba6fdc3acf6d075c36bdfc4f81df

  • SSDEEP

    24576:9AHnh+eWsN3skA4RV1Hom2KXMmHa5Fc895:ch+ZkldoPK8Ya5Ft

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2