Extracted

• • Target

    c5ab3a2b0cdee04b6cfd385a634573b3da5857d308b1ad5d107fe913cfe9e97c_JC.exe

  • Size

    352KB

  • MD5

    136fcb0e5f1f8f01355c76f82f521042

  • SHA1

    1780d6eae94e6aa09caf83160baf9b6100a3bae5

  • SHA256

    c5ab3a2b0cdee04b6cfd385a634573b3da5857d308b1ad5d107fe913cfe9e97c

  • SHA512

    82831d07b00018e16aa5e4f2f3cb0afc8d8c3cb265bfeb81fd0a6f06bd33a895b73b71c723fff733bf79b8d56be6584f745fb84d838bc1ae074ba8109838750c

  • SSDEEP

    6144:GiRg5C/D8frFV5b9mCIcbDqAxuuiqohdrZlhV8zmVIQU4P6AEpiCUBRWalN:GiRHb8xX9bIf+TBobrZKzmVIQUo6AEpa

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2