Extracted

• • Target

    Products List.exe

  • Size

    502KB

  • MD5

    23774a05b01b50041d854d27c78edf3f

  • SHA1

    f3bef4db75331bfc451737cbc34f8a1b882c3a66

  • SHA256

    43b81452ba3a471f0b239dac8bdbf3a2b59cfe35330626ae5a362ecece07fbad

  • SHA512

    49875538e7c40b04e39c728d884583b869852f708cc6ff4662b1110a156ba7d6ffc95cf942f43ec0c112af1acf5ef29eae22b88f8629f563f365394ede0bf2c8

  • SSDEEP

    12288:uH72CH8/BgWzP86/3wYkYgmic8H6pj4JELWlDDLNaqxw:y8ZNv3mYgmzpEJcwDvN3w

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2