Extracted

• • Target

    payment copy.exe

  • Size

    632KB

  • MD5

    9dc11bc9f45646da72f1fcd80ec3c8ef

  • SHA1

    6238eec6748e70e2685e8c2b58e9cbc7e41898ca

  • SHA256

    8ef5abf806b4399370b4c8a1ea4f0b87e995754b4594d751ba2648c55b71ad25

  • SHA512

    efd10d089aead06fe4dd841716f5348e94ce26fbf3b084a9345de28b88a79cb903a7ae7372378ed6ce6bd530eae739814df1b0d009bc2f5448168fddf50a9946

  • SSDEEP

    12288:pM9Dgh/PsZ1DX/VDJUS79oddN1hluiiahnUv+tECuLWJ:0Dgh/P7SQdDJ/hUG2Vi

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2