Extracted

• • Target

    1b9e4ddba53a3926fb050b6634986368.exe

  • Size

    703KB

  • MD5

    1b9e4ddba53a3926fb050b6634986368

  • SHA1

    8c64aeecd403b98f3f3aa56e237e7326afef1bbf

  • SHA256

    ccec0639abc6b69a99373bcac90fcd5d25095fcefde530e05c44e0059ee1b410

  • SHA512

    cc6a9bb3d95859be9b1b65dca4745fb412214d6324cda571630dc7fd7719954a935475c6cb92530a2b6692f9b5e43837bfb9f24d8d7b4c951fa8f7510fd9e4ec

  • SSDEEP

    12288:3y1Q2ngMtm9+0CSi1a/7rEw7G/1Gjdues5j38eFp5bo0+4g58UTVaOJj5BSYa+9O:Hu5LauYa+9dbwGCBdbMoXjS93jduVpeS

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2