Extracted

• • Target

    48769d9bf9c85f5285abc8e656352c4956c42e29f86102ff7a57be0a250938b3.exe

  • Size

    1.3MB

  • MD5

    2d6d625a52ac80d7df8b3b94a5308121

  • SHA1

    64cf6f31c3afcf0f1337bc221e154d719888a384

  • SHA256

    48769d9bf9c85f5285abc8e656352c4956c42e29f86102ff7a57be0a250938b3

  • SHA512

    ffe844207ea8bb5bfed8bf4c1145e32528f44dad58d4c509a3e70fa65d62c442e858f42feeabcc1930a50edcc6528fc9ccc3dc5eb9405284e3b601b8da4f5e6b

  • SSDEEP

    24576:3qDEvCTbMWu7rQYlBQcBiT6rprG8a22HTAwAodJ3A:3TvC/MTQYxsWR7a2m6c5

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2