Extracted

• • Target

    3aZnim03YZoCOjB.exe

  • Size

    871KB

  • MD5

    dd99bf6787f2edec1f03cee0918428c8

  • SHA1

    571bd427299e33dc4c47b3a6e8c0af4dcbfef0af

  • SHA256

    60cc2470b3941fd1e6020904750d3f030ac65a70670c722dcc241506224d146a

  • SHA512

    cd60f794eccff1412ce2c97fcbd0bd66adb560e443ae2ada2705912e52d7cdbf4c264c75d29b41085e71c62252172240def3f2f7a110b414b766d7c31e3e6c7f

  • SSDEEP

    12288:epY5dB23bB2gB2iNdt3fex00iXpiNInLHIJZegguQnMlGWz:epY5dIV2K1nt3f9xcCWz

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2