Extracted

• • Target

    353a6f797e3e2c4e296ee8e5a72e393657f8e84889edd579d6f239c5d4ada270N

  • Size

    977KB

  • MD5

    fea83f260f2972644d1dd41309f41200

  • SHA1

    859123bbf12e66d283c9a991f1ee62e8f7061ac5

  • SHA256

    353a6f797e3e2c4e296ee8e5a72e393657f8e84889edd579d6f239c5d4ada270

  • SHA512

    96d6676794b3a19506749ac7723a028a4c5f199ee414f80811f7cf01b4e2376917d444a0e0dc31d95439d5f41a2b0ba47fd05abac147912ee295a026410fa4bc

  • SSDEEP

    24576:QqNfcE3qokV5EkITpoWZHUkAjVhMfo9NWtxIVSfb+PP4Iyv10cv:QSkWFEEXyZVhf94txePOecv

  Score

  10^/10

  persistencesnakekeyloggercollectioncredential_accesskeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2