Extracted

• • Target
    09009876543456789000000.exe
  • Size 169KB
  • SHA256 4c1dcdb75a7b931ee96b2e7acb81c988d3a4eb6e4c5d3c4431532cdd2ad4ae3e
  • MD5 ef00b985340a8a5337505e46d4e4d172
  • SHA1 b6806c1a7232e3789e2fc9cac660800a9a5d082f
  • SHA512 4372cb584bff6d2d3ea9ca703c4ae50aa530851cb25616bc5b73cf1019323652c0aa6e1a634f086038b82268cd689c7b80be1675eca6e3a29c9b958f5d25935a
  • MD5 SHA1 SHA512

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2