Extracted

• • Target

    Payment.exe

  • Size

    947KB

  • MD5

    7084794e65207923c736c1e55e87abb8

  • SHA1

    cd657ba0e8442abe779fc7db5a63d502b6ef162e

  • SHA256

    34b91aa79335759905f9405680460480b9d3a759c32e972192c0e6c41f3d7c36

  • SHA512

    b03c499251d5739b1a5d05aea6e59a55432cbbd10034180814d1756d649f94aaead241e0dd91edd456a595108e5fb002ef3ccdd3eeabd5d16ec1e53256af8025

  • SSDEEP

    12288:UaXrxR6wz8NxSN2iNXHoHymQSi9rMebjjnk5X:dXrzB1ZH2yRrjjn

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2