Extracted

• • Target

    ed8a2741526c390d94d57de34aad4e3d533ab02beb98f6dfe428c281ec37d279

  • Size

    768KB

  • MD5

    b937cfc610976f5aed6dfd7aba0763c7

  • SHA1

    0df6374148b77143dde73e89ac0cfc485a7a2922

  • SHA256

    ed8a2741526c390d94d57de34aad4e3d533ab02beb98f6dfe428c281ec37d279

  • SHA512

    c1faae3d490898a9b549aeedc71e71a4217422b09a77ba727cda41faec41f50ff8d073abe73e086dcfa267cac6b2467b7324a625f3a1b5cc1d4dec8737f24985

  • SSDEEP

    12288:S7ZwdNNAUmugqIkPLtxj4iO4zqSmuQ2Nm1ndbs9a7frhB3mGjPzXRbrQyQpytTfB:WZGNKUPlIELb4bETQAYboa7DvXRPvfA8

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1