Extracted

• • Target

    Uecqyndauhl.exe

  • Size

    837KB

  • MD5

    7af8d321a3c0d9a27f7a9ab29ad5b16a

  • SHA1

    29e56ec4934fab9865fbd4d41698840fefd8b33d

  • SHA256

    8f0f73da0cf00759da7bdb027e9f33abfd04617d19ec3d574901b1eb36e21078

  • SHA512

    9f8b8f7be56ed8721c4a21f7fffc82b0f8a592f7b3871f55191a9355f6e8c838a8c6e7c61ef12ae4334445a3617250741ad24f42b276062bc368832eabad2a04

  • SSDEEP

    12288:b/y7FGqvrNujgr+w6u17Xh6uROvKDGSIlQVSjZfQg4lToURIUh9mJRJPZ6JvC7R6:ruGq0grx16uYvKslQERJ7PAqN7

  Score

  10^/10

  snakekeyloggerkeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2