Extracted

• • Target

    b8463b9d6bc9da19c88c2ae0f1ff30babd2cc9ce4434d43cf7a9e65db7abb5ef.exe

  • Size

    577KB

  • MD5

    f445596c3a4ba973e306e49bab78bd61

  • SHA1

    fe0767d9139426090cb66d73d31675a695cc0693

  • SHA256

    b8463b9d6bc9da19c88c2ae0f1ff30babd2cc9ce4434d43cf7a9e65db7abb5ef

  • SHA512

    003133b8d7dee998de3ac9a072e85acbd5d7941ae5f75c4059f1b622ad6aa85f99c598e13f9ebc83820138aecdea26a45af6fe00f7c19cb5f2245275bdc130f4

  • SSDEEP

    12288:ZbRKjP7nesYuGmI3PPgoriXT1AP7QRXPgMV:DKjP7esYuGmGPoxqT2V

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2