Extracted

• • Target

    3.exe

  • Size

    571KB

  • MD5

    7030700ead128aab5df0db1675020937

  • SHA1

    130d55bd32b2642fb27890a62e8eabd9b3b60611

  • SHA256

    31af8e06fb179797320d0d79fce8a7c603e6156bb0b0642a41fe818b4894eb8f

  • SHA512

    24718210a0562379e597ebef1b18731918d8e4907f29bc711f203282e1b674ce602bad6e872098eac23b801b44bd5d838c3b57f4b2951d0754a9ad550a7c6a2f

  • SSDEEP

    12288:AcPZbEeX/sYw0q59eiXjS1SvAqnYwgJOAI4UUDJLqi6r59l:AcPh//m9ewe1SvArlPIkDzm5

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2