Extracted

• • Target

    bd21ac3e8f433bd0c17492306ebccbc53a195c84569145eaf1cdf0f7d5efe277.exe

  • Size

    532KB

  • MD5

    a1eeb9ee07c2ab101fdb57f9f6d03e4d

  • SHA1

    883ce3a27978782cd3bf93c2e0b7fc041304c1df

  • SHA256

    bd21ac3e8f433bd0c17492306ebccbc53a195c84569145eaf1cdf0f7d5efe277

  • SHA512

    ed46bfb40323de538c576a46b612fb02f76b655b5bfdf1eaa34111290bfd9cfc40e063cb09aa1c2b647e0f09597b474b8fa6e0e2814cb1a4300d8827a3d08c69

  • SSDEEP

    12288:CX0nsD1jq2+ZlFfqLaP+I5sHaeV5WbsYnd425uGD6J:CkncqPwINreKAYX5uGO

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2