Extracted

• • Target
    adb993eff9ba1e824e93392fb01d5f05.exe
  • Size 378KB
  • SHA256 68cd899c048a9b097d438260f9a92513b6cc42fc203c8126df2bb35b86c50671
  • MD5 adb993eff9ba1e824e93392fb01d5f05
  • SHA1 e6a30a0ff0175ac10f3a81afe7d5178be332dc09
  • SHA512 ab838193b4fc1cd9a3b3f8a644ebb2a2ed10245ac86d16baf1ac00034efde9e5307394859c9d9bea672485bbdc45bcc753e4d760ae80b34279357d31fcf2a914
  • SSDEEP 6144:4/Al8AicJkF2BKad8oKMslp2TN7KjhhiO7wK+sW4xO93kZ:4/Al8AicyJiN+hiCzw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2