Extracted

• • Target

    212b67aa7c112af1b53d5d892e787b07b2edbfeecb22fb4d60781ba8f1820b82.exe

  • Size

    519KB

  • MD5

    ce69dc28f560bf9b3c582c95209a6e54

  • SHA1

    382ff38ef572983eb65f86b3bd590a4a1423e309

  • SHA256

    212b67aa7c112af1b53d5d892e787b07b2edbfeecb22fb4d60781ba8f1820b82

  • SHA512

    9664b5b5c6a0d493a7909ce5baf00fd51440bd703567022199161a9fd1e5e8ecce6fa5af46f78633acf6fc1f93d8cfc5a62039372995af3e637523931410d2e9

  • SSDEEP

    6144:T6ejWxd7pU7vroaXwxT5LSvObOPVaIrQJt/M7RMcwrENXjeUR1n099bw/c3TYy9k:T6skNHbOPeZrEVnhcd38yTVjs

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2