Extracted

• • Target
    fd45b5dda04e2273e59f4a5a2c1ee398.exe
  • Size 291KB
  • SHA256 86aab438cacf92cb5f7f5d2fb06541e9047191b52e72066280ea230d7e707e9b
  • MD5 fd45b5dda04e2273e59f4a5a2c1ee398
  • SHA1 9880f45106a91e4e409a72de5080909bbb3c05a9
  • SHA512 1e3b76d412207f98423633d94b17bc6257353b1f8d2010cd25f7b63d1a979bc8b2ef2a17f1df7a190736557ee299af73bcc3ccba38b340e3943c1f36b05b7ed7
  • SSDEEP 3072:ID288/YYYYYYyYYyYYyYYyYYyYYyYYyYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYS:nPJK/zes7ROPWBtV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2