Extracted

• • Target

    NEAS.57026ff81a3a9033eaf856d3b36a72d12e613e5227b7740abe4ccca6e95e1800exe_JC.exe

  • Size

    280KB

  • MD5

    2af24dbf80882f85fcb9b44324f915c6

  • SHA1

    d9e77d1e4cfe4e086872b9b5b56a028733e38334

  • SHA256

    57026ff81a3a9033eaf856d3b36a72d12e613e5227b7740abe4ccca6e95e1800

  • SHA512

    18347b6a48a6c97c74dcf99088347594c3a8684c2c99f1058d7c1b345240e8c1c4734b98727c089a19e0ce5910c18f4c5013e9aecf8975531253cb50cd63eec4

  • SSDEEP

    6144:Oi6hMrvVvL6mqARyhHhnLiyTAbU3vWeq06zvyduQpxp0Un0QEai7uxnZgalZRndl:Oi6hMrvJLcuylhtAg3Oeq06zKduEb0U7

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2