Extracted

• • Target

    Yjntdre.exe

  • Size

    26KB

  • MD5

    f02100eb5f3140c05def18e397fd6175

  • SHA1

    dabcc934eec02af1b9faaed6e911791272c1a089

  • SHA256

    fac373a26a5f0458890deea7bc93d6ea6e769eeb6440d56c5adf9f3da8838c90

  • SHA512

    8825f91409483d0ea8113ddb37bb7115c381fc2d5e5d2135b71ed04779714fd8f6f9ac9bb114c88bccc5c5efbb184de959d0af03aeb0a8faf06ec298154e493f

  • SSDEEP

    384:5PQ9Uh8DHZ7+tCO0VobNPnbn+b/AeH9F9wGjEnAtNCSGFqUD:duZtoZPbn+rLXiiEnuCLFqUD

  Score

  10^/10

  snakekeyloggercollectionkeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2