Extracted

• • Target

    Nedqm.exe

  • Size

    86KB

  • MD5

    634969e8d7e126dba7d9df1ba2495850

  • SHA1

    5678e50a87be9b0c46e52ef259e5624022b80757

  • SHA256

    9371ee974c4ebf35be61c05afbd3d3f73ac8d130346655b3374f7d9a779195d8

  • SHA512

    01cdbf8c51a874bb5edfb8d3c6db7855abeb84ea41fb407fe7afc0052c54f918f3cbfd6567af4fd951a6c32c6e76a327bccc8a2e81e3a08bf19b9f5affc1a80d

  • SSDEEP

    1536:CaCQ1GTdMdAP82dlvrmUrKiKpp7lpQJ5m1zr3iRNhtCCKyqw:MtIhqlDm0HK7qm1vi/z3n

  Score

  10^/10

  discoverysnakekeyloggercollectionkeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2