Extracted

• • Target

    04bce34a237f0ad04d1dca7d7c5b8f66faca166e5537c2357bb7fe8201656371

  • Size

    67KB

  • MD5

    b4223422ace7a2963199af04464067ad

  • SHA1

    d4dd69acf701c720e7d431960907423e96dc15a4

  • SHA256

    04bce34a237f0ad04d1dca7d7c5b8f66faca166e5537c2357bb7fe8201656371

  • SHA512

    1b0b86af07c85bb132002382840b1691623064ab3cc5431893bc3d9023171e39797e18301ba014dbd982afab1114076ad7fe8cadc147d27a519b0eeaebfd7e52

  • SSDEEP

    1536:i8zjFDkgD7ACV9MAG+sBhRDSwriLh5DEARnjJzDLnvvJY:i8vFDkgDZuABkrSXLhznjtPnXJY

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2