Extracted

• • Target

    mv Rusich-8.exe

  • Size

    168KB

  • MD5

    a65f687317f9463bde6232aa8c500034

  • SHA1

    98ccebd6b998be82aab4901627a01b24047502af

  • SHA256

    80aa377eca5db9a8edbabfb60ec2107a81c42a4915014d159829d2bef8066e83

  • SHA512

    a99ba332c6adf6f17e3697247c0bf99dfb52a11a1a2fa96ca5e438d888820dae0f1cb9bd4ab7f597bdfc5481d30a9fcb842d604036ad0c86f48c6217dfa129a1

  • SSDEEP

    1536:rx9m+lYg1EE8E8E8E8E8E88EV1qQqi+7C4JdcQQqUdpe:lA1qQqi+7C4JdcQQqUne

  Score

  10^/10

  snakekeyloggerkeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2