Extracted

• • Target
    bbd50d837a594c0e33c1581e4e4734d9.exe
  • Size 619KB
  • SHA256 fe67815ee34cf630592fdbbcdc8e18b460b6dcaf6cbfb4bce9c5d7d4c453e491
  • MD5 bbd50d837a594c0e33c1581e4e4734d9
  • SHA1 b1cb88190b0053eedda47b8f0311e5acdee04673
  • SHA512 f8d7d002bc457bfee2cc6a97db4b31342c391f0b78a0ff22e426e80ca28a38a0946673331636016c5993c30dff0e9b304750c8d252de62fa56b9b0d5f9c8e518
  • SSDEEP 12288:0r8dWkAVUsnGpIyhvRghNXeMtWTBIeA0ckVQkXPYh8sIbJ:t0TVUgMNEXDtWrYGPYBIF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerkeyloggerstealercollectionspyware

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2