Extracted

• • Target

    Tvccjkahqr.exe

  • Size

    17KB

  • MD5

    0e83d9def9f0d8b855725f0e0136201c

  • SHA1

    2846547d5f34abc3084192dbc6976484fae3c0a6

  • SHA256

    cf635b3f6775fdf343dee0e703f1ebc24a740d4b1c76ad11e4118bcc1e636882

  • SHA512

    cf274517ae75612af9bbcf08c69ecb98248098664559718f4bd76acd7d55945126d7b30a814c91ba239a88edc23fae34594ef479c9cc68361ca132a3f9aa98e6

  • SSDEEP

    384:MFqF+L4TURdJJsjYa4uz+0mYKC9fn9/Awh:0RdJJsjiM+dCJ9oS

  Score

  10^/10

  snakekeyloggercollectionkeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2