Extracted

• • Target
    62d45c2346c9751e13d4a8f917315518b06fcb55383a0faae3bf17455ace931e.exe
  • Size 130KB
  • SHA256 62d45c2346c9751e13d4a8f917315518b06fcb55383a0faae3bf17455ace931e
  • MD5 5cee9854a7c4acf59aaa22cc4198bc48
  • SHA1 862ff4bacfc83c1ddb5f94ac05ab82e6fb821446
  • SHA512 e898e78fae01e045de84933997ac81aedbca2934f3c2dfc8aedb49936bfec9d6d719872d2a6b6d7282e286ad1929c9f14708ba558cd586df483757119e244d75
  • SSDEEP 3072:c99yINAgKjV545jbvk5Hbe7fMuJN07TwNumqoywd5Mgb54pmW/ywvcXmYgbY:nINAgKjV5Cjbvk5Hbe7fMuJN07TQlvbo
  • TLSH
    T1F5D3084927F49804E1FF997707716115C3B5B8120B26DF1D1BD2F86A2B3D6A18E0AFA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverysnakekeyloggerkeyloggerstealeradwarecollectionpersistencespyware

  • Family: Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2