Extracted

• • Target

    SecuriteInfo.com.MSIL.Kryptik.EOY.tr.9446.exe

  • Size

    833KB

  • MD5

    e41e078e3b2fc9148a47941d3dc27bf4

  • SHA1

    73e23c1b9abababda08f1819cee3ef1c44e48137

  • SHA256

    a186d098f99b61a1324320f36aa4cad9df64d0352543e4179be075d2dab6ee5a

  • SHA512

    09af934e96d85bd0b4b0a63fe3f5bfcd8328388df2f701e078a11bd4b0fff536b673213a00bb69e82f4884fb11169e9e9179eade0362705c1dbb5b1f28b77833

  • SSDEEP

    12288:wUfwLR8lylSx1F4Y6sNhaU2msS1x+eWMfurLYF0C3onSNMfqFTMbEJtaFCOw8gSL:wUfwmltnsL5MIYFJ+D87PaFjNjrb

  Score

  10^/10

  snakekeyloggercollectionevasionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2