Extracted

• • Target

    IMG_50026_1780.exe

  • Size

    2.6MB

  • MD5

    4c0c7c80a3403fbeff4a66dad379cfd1

  • SHA1

    f303e2596c751322499c718b8f53972a7bd7fe9a

  • SHA256

    487a34ecebed99d0935c56f644325c884bc1fac51e14c9e4b81970a5a785ed48

  • SHA512

    ac768521c41e38d7b314e1a579b4de997e0d98e6268aca98133eb0566e73734b3cfe72f17492110222acb54f7873ee5f6f42a77e89a3d6812989ee14e29392eb

  • SSDEEP

    49152:bAA9nB0mUgYd/5xPn9OHkkWmBfdsS0Vstb:x0mUgexP9kkVm9b

  Score

  10^/10

  discoverypersistencesnakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2