Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.7145.3884.exe

  • Size

    578KB

  • MD5

    1b4fff675df6cd7b8256b9530d9f2da0

  • SHA1

    00e4ceab35ba0ef12a44f560ede6a61d4206619c

  • SHA256

    095874a28fb610214b5f0e2cb00246f160d6dfd3eaf8c8a033226e4266668374

  • SHA512

    faf119858a053016c038e34d259c74fc730095ca687b7324f8f27fadeac6837034fe07b17f9df66e2a568027e6f525435ce18699703e2d76ba3647966f73ad98

  • SSDEEP

    12288:YSncopox4xI1R3r65/aqqLWmeEs2KF36rS3rpf4w6aOmdx:YeF8Fr6b4WmeYuB4w6Rmdx

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2