Extracted

• • Target

    Hjhkcx.scr

  • Size

    2.0MB

  • MD5

    8ba4d8afe4e893752efe87e60ca906c7

  • SHA1

    3ef4ad6579868be2cb954a02003e5838e7195d50

  • SHA256

    29748957e43758e0a59ec98a377f55bbdd4f25fdd4ba10bae8d6ec997f580d1e

  • SHA512

    687932d3ad807589e254b3c89e7f77cc8d10e1275c05e0673fa26c58de037979cb75263cc3b1b8ded890b65508f94274255e3b76d828a9a73afb374c7295b4ad

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2