Extracted

• • Target

    8d38003a1a35790a116f039a0998f4bb

  • Size

    842KB

  • MD5

    8d38003a1a35790a116f039a0998f4bb

  • SHA1

    094eff2ab11ae19699d7dc5c22bab0429beb50bb

  • SHA256

    b8216cdc194ab1f82820fc2a29ca63af3a1f3e6b80102ab658c1ee33b7dd68da

  • SHA512

    e11cd051e9c91e58ba0f9d3ae8c498d8aa4993e5d27f97aac78e7a7529e370cfff4fa6a05cdb3084100144702a064bcbc03bc55793ebe2d432ea0ba7815cd07d

  • SSDEEP

    12288:7OeRWLigAwR4cLGtwpmD3U25D6uMlpwnm/g8AdLn8DE2dgCOWDC2xVmsrKa:1sAhcLGOpi6pwnmgdLn8D1O72qmKa

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2