Extracted

• • Target

    25824092416350.scr

  • Size

    39KB

  • MD5

    47efd3b8ab6e976effe36624d98fd0c8

  • SHA1

    d920072220b9ec9b2070e5f639ff67c6635841c9

  • SHA256

    df9d082b89ca10844909eaa090c003ddd9081b369b0aa37cc4cbd3c6a91545fd

  • SHA512

    593839894d56df016179d1b2063ccbf0580e031ac2fa6d02189308a113ce2953a6a7dcd72b0f303519a9f0f16ecbffdad7b140d9884f825167cafbd89c0fb145

  • SSDEEP

    768:4NKrCse1JNEGgyFiHWYlhSwNnBzoz9uPowEkdEmkNWK50wZUek:44P0J2FyFIfMuPl2Nd50UUek

  Score

  10^/10

  discoverysnakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2