Extracted

• • Target

    VkF80MC8Kd7Z5Bd.exe

  • Size

    686KB

  • MD5

    15a83d767191060be2ade250eb183cd0

  • SHA1

    c61c7f82af922b45ac694edecaa824aed22bae00

  • SHA256

    b0f20f8a79db9d246f9812607ca3fc0019fc6c7905ffaa333bc0587fb69a1e58

  • SHA512

    16082aec6537f6a0930b83f3b08e88bcbd6b3a418656711d2a89edee6b1885141f044f173e776ce6de24c03bc9fc5294227fb293e0818c5b7f49d4dab8e9d7c3

  • SSDEEP

    12288:5bAHH/DneK/bQPgPv3tQ78PoHiVtMYCGV/uwDP3e3iLmMx:5bKHzeKi7vHmtMapUiLXx

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Downloads MZ/PE file

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2