Extracted

• • Target
    draft bl.exe
  • Size 601KB
  • SHA256 f21713f098ba22b69b0303da4fe32dda9e1290f2d5986b9ff18cdd7de6f5d0ca
  • MD5 96dc02041ecf66dd61891ea7b7438ea5
  • SHA1 e1d3d9a7409ef44c2de1684e4513ea5016fa6cf3
  • SHA512 cb90cd3fd3ac90b634a16e8de4d65e27ef5505378481cc7a42eeec8a818946e6314d99c0be75c122a08d61c64ca8b8ed220a42db61b18ab8f2285926daaa251a
  • SSDEEP 12288:5YjA11R/5PS+/S4PFfCnc0etkwlIHTLFkeHvmej9D6qjYQVEjUqT:uEPK4FWGlq2eHueJcyqT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2