Extracted

• • Target
    51ef208ea36f798fe8c4f4a88bfcba5c
  • Size 641KB
  • SHA256 a82999d77adbff10ef701a595d165547fb73bf055dcae9b65d261e4d09c47654
  • MD5 51ef208ea36f798fe8c4f4a88bfcba5c
  • SHA1 5ea0c14f4eedeb9a76334c0ef6b1b8854b7c32b7
  • SHA512 6df28135bffb0fc54e3e45e97352d9177f1d1307f7e384ebe350c3d330c83c6461ba0b974010e92555ff6210bb271ee0d7788f69ea06148eead4398c0a5efb3f
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2