Extracted

• • Target
    2c05381215fae83cbab994f42224ad1f.exe
  • Size 788KB
  • SHA256 dc5bccc49bb0d66f7a484994101b62f0ec97e389ceed90dafdcba519e71aebbe
  • MD5 2c05381215fae83cbab994f42224ad1f
  • SHA1 09dbf9c3e39e542b648c84ec7a6db096724fc0ef
  • SHA512 9206991a07fafe3fae46b235eb6c375daef39f5e163893c6c8863b76c164f7f282eff03c350566f96d13522b43582cd312ebade51c55ca8c14049d2bccf66cf7
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2