Extracted

• • Target
    XY098765434567890987654567d4beYmQGc7ia9.exe
  • Size 874KB
  • SHA256 6983864fda339a8423140e57363e78cc072d779bdadcf54e812dfb987f524d0b
  • MD5 37721160629b9211ac5f8824550f8740
  • SHA1 d56dacda4530e8d50bbad6ad5c3cd9cff8b2a096
  • SHA512 29cffdf6280f9e3f9285d75a885211e8bed19751c41ae6c9dc6f35cdb7b8fb31d9b9db78f94e719ac2b3643e0e9eb8b038200edb5cbb1c7d084571fc452ba511
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2