Extracted

• • Target

    85f7f26cd9cfb9ab367d083f60b48e1594b1eadf8dd1a792c347273684855013.exe

  • Size

    830KB

  • MD5

    2c4ce1a8eaabb150842428fad62d3aa5

  • SHA1

    3b363403e579459a7954c4564c950041327c755c

  • SHA256

    85f7f26cd9cfb9ab367d083f60b48e1594b1eadf8dd1a792c347273684855013

  • SHA512

    7d7ff21e01c5ede70104f2819c3d61056df222ad6943bb257c1dfa38ff9d4f8b2da070b97847f8b76a5e881e99c10db754334022a3f9eb4f12ffcc4e3f0bbbb5

  • SSDEEP

    12288:fWmfDfxt7J0iJKfJDbV5wPw2a7iLv1/L5le289QgM8B:72RfJW1Ciblvng

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1