Extracted

• • Target

    b03066c712ac4c570433b996907d239a417eb0ae517307faa1122dbb560da08a.exe

  • Size

    549KB

  • MD5

    b5a3a038692a38e4efcd86e079557589

  • SHA1

    18c533cbf19bfbef0959bf2c1a8d2251ab4e64a8

  • SHA256

    b03066c712ac4c570433b996907d239a417eb0ae517307faa1122dbb560da08a

  • SHA512

    5327b668e44bea2bd5331f50b1dbc99f3c3110fa26fb48791795ef8f3cb461d650dfbeb0d5ff9049fc1579bc232ad9adffb1ee9b761e39e85b68afcba0acfcca

  • SSDEEP

    3072:JNWTb+AdIg8j+kCpeD0D7L5HA1onW8D1mw5FPw:qTb+Ado4LTUAW8pmcFP

  Score

  10^/10

  snakekeyloggercollectioncredential_accesskeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2