Extracted

• • Target
    Jinwtqn.exe
  • Size 20KB
  • SHA256 6170f056f1e5b8b06adbdc3e075a2dbd0d8f71a8bb015f6d6d083a600bf3fdbf
  • MD5 1265116c4041b2767faeec27d15d6070
  • SHA1 3eee87dd0912e200c65bfc234cf4c5dd249fbb20
  • SHA512 dd10e6874c9588c152e0aacc881721c97a957527e997717496b7ab1dc0882647bc64964d77070bcea1720ac0afc3180d6dfa576d61eafa540b7bb70a275f1e71
  • SSDEEP 384:dwgrffffiYYYYYYY4fG2p5LPT/v/ok/iTIsyNPNZJ9afel:G3YYYYYYYMGO7z/mI1l
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2