Extracted

• • Target

    9c0df6bb5a583077732c10adb7c12ade664b637f4f2fcd9f05c90a5c3577d010.exe

  • Size

    1.3MB

  • MD5

    1598e0f57e2396152ed603ff8832cb30

  • SHA1

    f7679b18051a9daf1daf683c3249c8fcb3d9d82c

  • SHA256

    9c0df6bb5a583077732c10adb7c12ade664b637f4f2fcd9f05c90a5c3577d010

  • SHA512

    57bc83847fef987d2decdf02f72f3a030032f610b1b39a10a1db0f16329ca49f972a7a0817a89493ea0654b233f08ea8b58c17a3c945b7fd0909ee15fdbbab29

  • SSDEEP

    24576:9qDEvCTbMWu7rQYlBQcBiT6rprG8aU4pjS0h/dSEAMSJGciQBIZX:9TvC/MTQYxsWR7aUES0h/hAMSJG

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2