Extracted

• • Target
    f3e9f1f45707ad6feb862a9026c77003.exe
  • Size 931KB
  • SHA256 ff3f3b2ca9862a3effd4e7f4410f4fbb2e7004ae87860aed3a3015e38cd7349e
  • MD5 f3e9f1f45707ad6feb862a9026c77003
  • SHA1 f82097ee64c008a10d871e0cddee99f0d105a881
  • SHA512 9aa7a5740e0bc69ea5ead8d3efe6b71118944ae193e44dae58c434b02ea4d089a657094cc499620cceaaa9effefe590b17af2d0f24d1afa8d79d6e63dac6ab75
  • SSDEEP 12288:t67JFsADz1KAAatftqzwnto+gEd85dY6R0MrdhX6SKmEZgzsRbItm8J:t4t+wHd859NrdhX6SKmQgzsJ8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2