Extracted

• • Target

    New_Requests_35003502.exe

  • Size

    640KB

  • MD5

    c35701db9ac9d8b75bb57b2758363804

  • SHA1

    fdf6f6997c0dd7228a904d70a2cbe97151c3405b

  • SHA256

    2d5fd822f5e87ccaac8fc9a90050383aed0e32abc3d54378357116771291af05

  • SHA512

    63562fb8154017a61a3e64fbd9c09494c6e87ba0b50352002be6d2c0e4e036caa89bf7212ef8cabb5936a2680fd5ad0a3cda6e87e97854039db53e01ee34db26

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2