Extracted

• • Target
    fb5def67838a6d9d99e0bca375bc9f28.exe
  • Size 736KB
  • SHA256 2d7a6a2e84a28af882953d2c6e8ba18952f84eb7f7d5658cb26cfa6bc679c8c7
  • MD5 fb5def67838a6d9d99e0bca375bc9f28
  • SHA1 56c4758660f27d3ad92ff913630d0187f1e14a1a
  • SHA512 6f5e51b43ae25c56691133ac1baa6d3c94811762a960cf4354882dbc5e6001ef948f5fcfeddb20f11331ed27d70d28e53c37e1f51a62a66173ecc07f8024df27
  • SSDEEP 12288:SFDMOvHJMZJHQglt/jT/Iga78++MY8wLqDY4YrBAS/eVNOGvK:4vpM0UbCD+MxfYrBAIeV8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerkeyloggerstealercollectionspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2