Extracted

• • Target
    db4426920fe2de2bbd7518585a388d19ec49e325ef0ced13e7736c603d000248.exe
  • Size 839KB
  • SHA256 db4426920fe2de2bbd7518585a388d19ec49e325ef0ced13e7736c603d000248
  • MD5 2f64fdfabacf9239147678c9a7b9916d
  • SHA1 42409d5c5019929625db7b4e35d087cda772b895
  • SHA512 2fad4063da0f9f5753bcb2b85d2d9cd0b1e9d04450c745a73be59cbb302d8a349b582bfeaad598829dd1e1e7c5cfe8f46b1a9aef14482ce4cfe336bc534495a0
  • SSDEEP 24576:KgF3O6RP+Vd3A/nrxWcEiqcGMs25maYmDumdm:RF+6RP+7w/nrxZEiqcGomaNm
  • TLSH
    T1CB0512282A12D503D65597388B71F2B91B7D4FEDA401EA179FECFEDFB96B9204C00186
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverysnakekeyloggerkeyloggerstealercollectionspyware

  • Family: Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2