Extracted

• • Target

    Attached P.O.exe

  • Size

    647KB

  • MD5

    01678283a7d176068d9941f6b40b1421

  • SHA1

    500f7b1cc45843106664fa75258bfb7ea88018b3

  • SHA256

    9704feee0716616c0b6fc608c7cfd69d780e9f9867a130209c92732124d4f514

  • SHA512

    67c9bfc0b5e40f6c52a5d5e848fb9621fd4bbe2174926a7abe91fdd468cffbaf78c2496fbbcda7ec6183c6e2f4e89b3eecb39f9f52ef0048f61191425df2cf18

  • SSDEEP

    12288:l6+wIZTSL5oaovT2lPK7Ji7Sxf8ncleeSuOYbzNH/rs0dFEVinRCYkIo:s+wIZTkg2BKE+f7ljS+/vLk

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Downloads MZ/PE file

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2