Extracted

• • Target

    4218d4a03fb87124e33562f14b385c28ea9ef1085b2f389d6da8a2c0dc20ce22

  • Size

    764KB

  • MD5

    d90d42631511b54444b9cc592e5a4aa2

  • SHA1

    0dbd67813ffe59903638e01af41b8517ec6a8459

  • SHA256

    4218d4a03fb87124e33562f14b385c28ea9ef1085b2f389d6da8a2c0dc20ce22

  • SHA512

    ab8a5fa1f5fd5e6cd9901b8d6093f770dde667a3e99c8d1f57896be7837d9c5e69039587c8ef917442733f58b969758a964d0141849ba8714ec2e9846509cfae

  • SSDEEP

    12288:bwV+t09IZrnJtERjxSvfe0+qvwlqxQlUDruQ:bGW09IZrnjQVSvG0+qvU3lU

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1