Extracted

• • Target
    mpclient.dll.exe
  • Size 2.6MB
  • SHA256 fa8d09a3d211aaefb69b1438a2b3bb45cb30b84162a02d7d291d8cbc9b56b508
  • MD5 6dc0abefffd9a3e27cb7f8ebedc2fd2c
  • SHA1 22d28687f52612ec57789383ac3abd74a6f1a7a5
  • SHA512 9392f18293941073b65b87517ec31b36a7a3668d62d9ab764b217d9651bc8972b5d640c1c42704034e384cb325fd0d9266a96163bec02c48b4db17e3c2472e88
  • SSDEEP 49152:xIOJpIhAyfFoUMtrCub0WYxqn/XaRBRui4P11w9vCAxFxQY8Flj1sHB1e7:xdEytJ14TxjQYbHi7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerpersistencespywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2