Extracted

• • Target
    _b00bc04de51686ba6cb951dbe6645bf847be8e6d33e45736adaea411cb43b606.exe
  • Size 913KB
  • SHA256 b00bc04de51686ba6cb951dbe6645bf847be8e6d33e45736adaea411cb43b606
  • MD5 729ffcafb1b4a28bbe20ea0ff67c6b42
  • SHA1 23d37772fe5cc65cf6404facec0576764f536d3a
  • SHA512 c8d8153500f6a415356684c0a732ce3daf4ec6a8bb3b65d6b25038bffc8fd0dd1d76db360f1cc6ab7b700cd63d7fc1ccb5114bb9e0b83ccb58bd2022198fd73d
  • SSDEEP 24576:P4TS19aX0Axf6h+SfUqQxbIAKUSHBA0XG1TDlUp6k:P444Xdf6heqQArrcVU
  • TLSH
    T1A7150150335EC902C5E75BF01861D2F916749E89A912E313CFF6BDEFB83B79129092A1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverysnakekeyloggerkeyloggerspywarestealer

  • Family: Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2