Extracted

• • Target

    6e39d4d2749a52559339cb294ae1b3cdea82d56b8dd8e6b45fa752d4cf003d84

  • Size

    1.1MB

  • MD5

    13cbc3bb36b5d10b118be85aac0ba6b2

  • SHA1

    dd1bab4857eafcbe24b16189c051593de3c83bd4

  • SHA256

    6e39d4d2749a52559339cb294ae1b3cdea82d56b8dd8e6b45fa752d4cf003d84

  • SHA512

    4fb98cd3db0e9ce142bf4388c7b96e3885b4cbebd30710548aefecafbca1e94897a347ea6fcf8c8371b17684912cf612b4ad1b43d1d036c3f3064c724dca02cc

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaCh6IrfKmfyZV+Zf+z8x9:7JZoQrbTFZY1iaCh6cS7v+Zfc8x9

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2