Extracted

• • Target

    97aa70078b62693b212b1b210268a10fe423294f7ca03f922fe160a4708dfc91

  • Size

    532KB

  • MD5

    f4943d4f40cf9c1cee2f32c17e365837

  • SHA1

    b428d56e3f8d2afc032a8c21f21e27d9125ea2f2

  • SHA256

    97aa70078b62693b212b1b210268a10fe423294f7ca03f922fe160a4708dfc91

  • SHA512

    64a30927a5fb6843aa4188abb3607796797648f963e86a78dab5be0026cd5a6995d3488c096ae4f61d6e5a0294d5086cfca18dac20025a0e03b80257d31c6367

  • SSDEEP

    12288:CX0nsD1jq2+ZlFfqLaP+I5sHaeV5WbsYnd425uGD6:CkncqPwINreKAYX5uG

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2