Extracted

• • Target

    hsbc swift.exe

  • Size

    748KB

  • MD5

    84410ac9abd7ec60088e84613377db6c

  • SHA1

    d2f4503deb31982ed04c647d3c723a14a5775a1d

  • SHA256

    786c92b68ab04326434ed0e5f8958f04150529ce41b77b7926bef112be70133b

  • SHA512

    1b1cd312e2747557655d60de32494da8dee0cf3bcd7e1d2429690ef1c564005bdaf41e0b800ea1d1e3750a059bd69f732e5cd4edbb4567ed67a708a306a11607

  • SSDEEP

    12288:wvSqYOE5jq1fdE5rV9MX/IF1MzuAjA53aesE1gqd1twx:BNq1i5fMXQ7MzuAU5qedFs

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2