Extracted

• • Target

    Quotation.exe

  • Size

    597KB

  • MD5

    370998435837711362e2ac7776b06b4e

  • SHA1

    8911e8aee386057e39f9a65150a6ff22c91d4b11

  • SHA256

    c38b465d0723cfba8e741705451d5b4917f09640664adf5bda6c0e48026c6b3f

  • SHA512

    5b13a94066f74e15d8c543df99eb964f7b847c5765eabd7c4f1bc8afcc5d2556a2efdf2176143c3f8e018b68a38cf93722bba10cdf4cc5dc8e5420da898dd71b

  • SSDEEP

    12288:k7jynpbY/Cou8nJJ3gaIDooNc/vco7vQWFCab6g+s:ppbY/Q8nwvVNgvZUab6

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2