Extracted

• • Target

    5yjBTV1RX69ix2q.exe

  • Size

    573KB

  • MD5

    6b4f6cc2f9b20734530acf3124a14cac

  • SHA1

    a07f1d4fe758c87819ff62671e015dbb38b8a7ac

  • SHA256

    d0018553788684559db6376fe759c7eb91b56532f24fcdee4468dae430511231

  • SHA512

    9000588d205a4e8ce68f3f6568ec9b82be16c85cd34695c9045f6e968f6529316995efa8cd11c889fcca89b287eb3e8a7a9d079662eba71aa3e102c79f194eaf

  • SSDEEP

    12288:QMiyiRJU/WceD6+kpqkIaHkuhirf6Kgtom55Nk5PMVFS:jZFe/ZkcH+kp2nHHm0

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2