Extracted

• • Target

    SCH09876568009876-0900.exe

  • Size

    362KB

  • MD5

    aa5a9b89face6a291cf9057d321bdbb9

  • SHA1

    d32b056096e926d6ba6ed31acf144e31eee6aa0e

  • SHA256

    3e6e127fca912f8729025ec259e391805ff42648fa75c34f9ccc6551cb7fba55

  • SHA512

    21b1876cf85d48a7cc54df836dbc2266e48e57f9679f260159185d78770b93334f06e8def42729021ffb082d822acf6d3cdc7839c9be112df9f31ee6b765f169

  • SSDEEP

    6144:r0nJBIKD2SJMz2dR8rZNlvzd4o6adHT3+lo2iUSe7Ye8i9Sw3Kc50RxTlSdk6ces:MJfD2S+nRd4CHCTi/hetSw3juPek6ce5

  Score

  10^/10

  snakekeyloggerkeyloggerstealercollection

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2