Extracted

• • Target

    7c0662078b41306675a32002a64a5dd5.exe

  • Size

    490KB

  • MD5

    7c0662078b41306675a32002a64a5dd5

  • SHA1

    5c327905044b8bf4e145a108efc6f87776647c01

  • SHA256

    27acd040d5654910a0b865eb5f9aef8f1dd8b646d8301023b7021089702aaaf4

  • SHA512

    378b6c9be84b6fa86a6c990acbc7146b3fbeff05533967956fc62f829b9dd42e9c77fe9b98afcdd68e7bf8d63a39df1637ef9d751b02cc26d8ad1d5d8f83f0fc

  • SSDEEP

    6144:3MN3jkmK9BCR91894QvU1nMP3onm4w7EAv/2b+2EUtKWRLffb9gpga7qAD4GiB:3MJjgCj1PMnPNhv12R5RLffb2pgmqFG

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2