Extracted

• • Target

    Fnjnpedy.exe

  • Size

    32KB

  • MD5

    61a347aa80bae20fc5908ae86f8790ad

  • SHA1

    2163cacdcb0b91e2a4c4cb2e2e021d6148961854

  • SHA256

    41ccb4c165200571b2d10047d7e25c85e7a270c2bb6c3438c7f8edce7dc2fc9c

  • SHA512

    e1cfd42004c0c1c32af49632769ba84dd93c128e210ced9f47fffbbd3f1324885e4d830b90432c83082c17c44ada91878c33585bdd5cb27c3b47486ae9ecd30c

  • SSDEEP

    384:LzsL/CyUCVnCMr2jEKqv++7Jk+qY/sgKwLF12APL6yRqtxAx+roEOPVK/KO+zB6a:aUCVCMrJJd5pRKs3RqtGx+roLYP+ka

  Score

  10^/10

  snakekeyloggercollectionkeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2