Extracted

• • Target
    1f2f188536e58972140279a1fb1cc731.exe
  • Size 690KB
  • SHA256 b5c3d613bed886b4af1631fea8c24cd3e2d73b4a14885d640be56de05c2e637a
  • MD5 1f2f188536e58972140279a1fb1cc731
  • SHA1 ee2ceb30d49c7689203b04b980fe0238b5c30c09
  • SHA512 e76c8c3cff7fabf9772182d64309569aa1c1fa49e0f3e150a75dd93fde8593f3a6b3def58b9e0d85c3b386b2286f391832c0e2ad4d3f3ab7113e6e03d0b4bce9
  • SSDEEP 12288:bVRY0hGZATnfxBjXqZllykeFAiyiVWv+Nc0CSoOL:3tzT5Uc/ai7wWV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2