Extracted

• • Target

    Ttwsg.exe

  • Size

    64KB

  • MD5

    92877b963c90599d222a3c851dbbdaa1

  • SHA1

    c2c4de2c7c5681f3be5c2ddca7f5ff7330d76dfd

  • SHA256

    80b55aa26af1c8cb84556ced208b0338313aa010bbb544cbb6a87f023b77899b

  • SHA512

    bd6b41b405cc333ceccd24fe68154216d1a8104639e5a1fe488f9436e2cd8a1e4900d81ef81364f0f8484d783608aef0632afee7d05677889f335d8dafcb0c2d

  • SSDEEP

    1536:lBWET/xqKbqqMaWFwRfi0BVIHrtokNgRxv4v:l7/vGii2VILtPaRxk

  Score

  10^/10

  snakekeyloggercollectionkeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2