Extracted

• • Target

    8372e04e3eb4e1534143534f62e8a57de90333c2925053556bebc077619436b7

  • Size

    1.8MB

  • MD5

    9b5a6f627c74f828bc4e85e2e2843e0c

  • SHA1

    96928dc02d3d5bc49648e33069c3892102453854

  • SHA256

    8372e04e3eb4e1534143534f62e8a57de90333c2925053556bebc077619436b7

  • SHA512

    80b4c2bd39b5b7d8c525b4e9fec8eb49175bf317ece8df5df9e204d255baf9d216acd2fac68af58d02f80a377ce873d5cc99691f9b94581d4d51874d14afa30c

  • SSDEEP

    24576:9nOpWWj7ipD0a+lfmRl25QaWvj5w3eIu0:SmRl25QaWNIu0

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1