Extracted

• • Target

    bad1.exe

  • Size

    40.2MB

  • MD5

    3de1b681a7e0bd3ab0eab17397e71d67

  • SHA1

    38af65d2a7153862c97f6549be6808263a41d37a

  • SHA256

    c4f91a3c477d6c7ff7957ee33d1729d3df95c1903416cdc830c4178fd597c8b1

  • SHA512

    68833e4c0c51c98ab5e7b1316653471ff69bdf5b208007b40f8d6b647f193fe84a0b0413e46018fba77b53a2ce327276289cbd21cc54dc28dcb4df31383d5407

  • SSDEEP

    393216:q76L6otUitqtH7wHtXq2pt2jbOCacCFIK0fpP9HF4VW8yfwnVQx4urYsANulL7NO:q0LoCOn+2ws4urYDNulLBiua

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerpersistencespywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2