Extracted

• • Target

    G1634-385760. approved.exe

  • Size

    640KB

  • MD5

    6ad52612b645fa22eab78384cb1a7b34

  • SHA1

    dd56aa5b46aa1354a4a54288cd24fc8762f6b8f0

  • SHA256

    77c9fddfb4cd4c0281bf1073491173b12e53886446aaf899ed2fe0d8fca451ab

  • SHA512

    064005780b67682234e5285d611949dcb5a13a58afee20945d3112a23a653afe316bc9ad602a48d732958c3d9c54f7be3ce7d0c7329b752789c4c1bd3e0168f4

  • SSDEEP

    12288:O3h9fTem2mOxSLoI0nGc+u48FG9UHWs4u7QLvnbmjRDe:Qh9ft23koI6YM4UToLvbm

  Score

  10^/10

  discoverysnakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2