Extracted

• • Target

    Tfjnxiks.exe

  • Size

    23KB

  • MD5

    4a92a35506b612f74f70eab6c6e806f2

  • SHA1

    2bb0fd33705a6d7451740de2381035a18d6d7098

  • SHA256

    f4dd38fe1cc238d69c12b35d29b745da5290efca68e8271e4dc80c7a8659c398

  • SHA512

    ea04cac8f1cbc7b5ac4bad1a76ef2d7d31138242693d6f5e2be40c240a18ea9aae16b0a0c054b95bb606831b9d3bd56a732fa960e39b189f080727cd8fd73895

  • SSDEEP

    384:d+unxPcTgGjjS8igT/TnFYuEbhbZEs9bhU1u2bQ1fxwQUNjVrXo:dNnxPcTPfSyTrnFYuihNbhUs2bm+QAB0

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2