Extracted

• • Target

    file.exe

  • Size

    1.2MB

  • MD5

    9f488e91936c3e39d4c8d9923d067cf6

  • SHA1

    441ab47e76bad211060e7d7ef4a58911a98a3477

  • SHA256

    445b1f82727b8efd01c1270643deb6bc69ef1654ed8f53499fe06fe4be77c977

  • SHA512

    cea41c7d685de273cfafa1f4a404a0aba3f32b98f807d974ac033e1de692310af4b14bab44160fef41691964db50faa4f82789d3b1f8da750eb2f0a533ebf898

  • SSDEEP

    12288:mQMZ/k1OHC+BNRz8knXWG4DIWLt5Y345yOEmmTM6iM8ltt9fkfhSPc+3GYNsMJ:mQM7tWdDIWZ5Y57mCTP4lk5SBNsM

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2