Extracted

Extracted

• • Target

    e58e541ef0c30405eef7521d7ff601b3bd7fbe20a776c498ad29d06a1254ec16N

  • Size

    652KB

  • MD5

    2139f7e79cfe9325321cac70b5c921d0

  • SHA1

    1eb101f303ebb55be3c0c244f741951b9649a1ab

  • SHA256

    e58e541ef0c30405eef7521d7ff601b3bd7fbe20a776c498ad29d06a1254ec16

  • SHA512

    a3bb1c2a2ed95b9fe7be8ac17056ff1c56e735dc6b823c6774ecc0d61caf1ebbc1b9447896dea6ee8c0c2fdf77603abf5537485d3d935ea5166e7b3859a03dd7

  • SSDEEP

    12288:BxryK1o5XcSqbMPfO/T/ZiUSL3GxFt/UQytB7DQ87MS:jygDSYMmlyL3GZ/UHK

  Score

  10^/10

  snakekeyloggercollectioncredential_accesskeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2