Extracted

• • Target

    Bank Swift.exe

  • Size

    830KB

  • MD5

    aacbef36fa202e5eb1512c99022ef31c

  • SHA1

    97a12e69a35a037f34bbd4b4d779326bdb99ac7e

  • SHA256

    4d4be5a0fb152cb0f795f6ce36b1b3e4e69234681e36c41f3760858b4d38aa31

  • SHA512

    5648dbe1a6c3f6aef53b1c14ba50b3837c2671a00934a0c3049d31711b6e61f972b2d7b1b3531ea6db671e0a22ec208759e1aa0547ce5cf4e906a201756dc84a

  • SSDEEP

    24576:Cw/HDtU376CVtv1ekon6imVSE/HHkFg/IyXtrpc:o3tv1jftfkoXVp

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2