Extracted

• • Target

    3388-1094-0x00000196CB800000-0x00000196CB824000-memory.dmp

  • Size

    144KB

  • MD5

    449157a8a4d853512272e1dc75912dd6

  • SHA1

    0530e3baabc4eeea9c28bb6356c06f333d611a74

  • SHA256

    f3e0d5f20a034d23ce28e8eaa78edacca31ffbe06a89a6fe238c1c6dd7c0660e

  • SHA512

    6c8c765057edfba56b7bc76e2198d2f78cb6097e449c4ee49ed23a6f3ff9bd9618d2ec7c520efbb0b06f5df52b8f79c547fd923caed2906e6677d1181c1b75b2

  • SSDEEP

    3072:b8ysYnWIUHMvK4TrYM6or2mFV4ITmbtXSsYtwv8tfDbY:mYnWxHMv9lN4ITmbSLb

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2