Extracted

• • Target
    4o2gVSxWoh4GNBn.exe
  • Size 735KB
  • SHA256 fd6a88c61e8b5b68f3f70d8aab48dabdfc21d96d81f823647d310ccbe1fd968a
  • MD5 aadf0cec059c6bea43390f4cbda89a01
  • SHA1 5d14c29e1f9b80de80b4e5e17d688d02c0652ea7
  • SHA512 72360ee3063cc53de3eb9899670b0e216fc8cf007ac12a43d88a2b156a1b4a9b24b1c3d8a0340b775700c8cf6a769983801047cb01fc85398ecc0563452a18fb
  • SSDEEP 12288:UlZfTMVrwn4CjD7KGDCXBt9yCdBKC+Eo2Nx5O17cOfejPSgeLbT7lYEAG:UXLMV8VIxt9y3Zh2bgyKbT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2