Extracted

• • Target

    0fc08d0eb269523c591182cc145972e8

  • Size

    747KB

  • MD5

    0fc08d0eb269523c591182cc145972e8

  • SHA1

    aaa1ae99f11cee2e3c30dde2d9a0de85034566f4

  • SHA256

    3d3ea97b77c432b2723c3fe7417a25f1cca2c3aac1174e5591a027cf00cba790

  • SHA512

    f280780beb6bad0177a726851f7dddb3404993e9fb403fd1e747419fee360c193c069883b20e7af8b7e58ecfe9b6688ab3048ab2c14e38ce1ab3b5f7092cfd1f

  • SSDEEP

    12288:PwawHRr/CB06KuLp9zdZD/meJEvGK4GP09+QzT0+1NN2AtJpSKX+XH/IdNWbDDlG:PwawxO5d9zzeeiv789+oXJ7tJpS6y/I0

  Score

  10^/10

  snakekeyloggerkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2