Extracted

• • Target
    d048d12ec9499d0b61932a060ed363f4.exe
  • Size 731KB
  • SHA256 e7bf652f61fbfba9cbc5b2785e2c806b48b221384e838c022adaa073b84dbbde
  • MD5 d048d12ec9499d0b61932a060ed363f4
  • SHA1 0ce9defa6805f94373b51a6e93a19e53c42032e6
  • SHA512 ab042c2bff5d35243d91ac59bec42f6e5db15dc6d9a0503524b160aa041f1cf902ad5e6f8ac2e58872bdad635fa47171edf1ed686ade6373c27375d44d1b1b40
  • SSDEEP 12288:XpkCPAqcXnyXx6q16ahRZ5GibGSwY+inEQQ6l0ptoCLPFK5JNc/0:ZAq1NMS5G3ninEzPLc3X
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2