Extracted

• • Target

    Quotation Reference No DX2265.exe

  • Size

    503KB

  • MD5

    fa80fb2fedf1df252aa7c10c6cf22ff5

  • SHA1

    65dbe24bb00dc5278926b1849a1e853d72d6d372

  • SHA256

    8c9a2cdbc372e1eb39e247cc1d444c7b97c35061aaf9aa568c421fbc8c0d0cad

  • SHA512

    8fe343882e1627d7a9c36809ca051f27f2cd37769fcb0135c076f0173090acbac76cda912bc934d299c5465f7f274ca3e68296b1abadfa0b32141a2c9d25a909

  • SSDEEP

    12288:yg72ChrTx3+u+KaqNbXq1o8lIyBnxlQqVMORM:1ngjKaW6dISnxlQqVTR

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2