Extracted

• • Target
    SecuriteInfo.com.Variant.Strictor.275348.9253.14582.exe
  • Size 801KB
  • SHA256 3b7b4ef071bf7db6cdf5be21c0ab645e03ad70277b101785534ef8da35b354ca
  • MD5 914e987761c4ffe94556f7888f45fdd7
  • SHA1 5ecca6d8975a3d23465e420b390504f37d6ec591
  • SHA512 cd78e994a4fea28c7335567acb70096d73643208fbdaf77dc816945013ac0892358f041c17ccfc64d0db36b600899e05ba13ec2b39970f4616ee72b3f8d32ca8
  • SSDEEP 12288:2fqR8gmBSvexxD0R/ncVhEHRl3GvG/QV2qg6:2fm8KAD0RviuxFYVP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerkeyloggerstealercollectionspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2