Extracted

• • Target

    Commkkhwb.exe

  • Size

    68KB

  • MD5

    9978b4e89a86b7e659e6d50737a5a2e3

  • SHA1

    ae5553562926cdefd411108d898fed36ed69bede

  • SHA256

    e74eac907deb295455e5856a2f4030c175a134dd3f2d681cec2d59ebb387c275

  • SHA512

    55b64faf8aec29f2e5600a8f83cf366f080d63cfec26d767760d9f48774b177e54767b84f6916bee585e4c8020c4a49dc53dc2fb59af898175b2b2cf81e473f2

  • SSDEEP

    768:m4GpAgE5/XuIHDI0w7yrSAllWoqEqRyflqFwH9SKzaDq/qTplPWrFDF+84PB0/tv:aAgkuOuyrzlhl8c/ti6GCKoqi

  Score

  10^/10

  snakekeyloggercollectionkeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2