Extracted

• • Target

    8e1469a8d3fac63fefa4affff492ca82c6d3059bc5c8097a38c04e4e965e1a39.exe

  • Size

    633KB

  • MD5

    b37fbc315b7e7bb63be8df480dc06e9e

  • SHA1

    4067d052f93087281edbe16f86cfd5fbac07c145

  • SHA256

    8e1469a8d3fac63fefa4affff492ca82c6d3059bc5c8097a38c04e4e965e1a39

  • SHA512

    7c95ee856caba832301ef0eeafd63807d620c645eba424589a65ac8d2973026d3c5986e0947d2f9a78d5a3e91441132b34b690a9d869a443f86aeeb7a0e2c0de

  • SSDEEP

    12288:lIwFcDL0sj9HstDlYsjnZDw9MGaUPExCQ8NqEwrJ9by/C:2wFcDL59SDlYmw1EoQ8NqFJ9bmC

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2