Extracted

• • Target

    10a3c3a3c388b4bde384068720dca0e0

  • Size

    316KB

  • MD5

    10a3c3a3c388b4bde384068720dca0e0

  • SHA1

    cdcfa097331476d5ee6e713923ac69bbe0f8448e

  • SHA256

    6e47024e23846e53598fe383b22a61d66060d95013c57103763d1f923ef6a505

  • SHA512

    c9b9d9e315867ffa3e7d6a7c88affa2fd16f9cb505b1b5bde0571f46952776d6932ae7474dd5d04a7b4e485e06c1dde7748ab6768e5e50a4635a307fa07fcac0

  • SSDEEP

    6144:b8LxBqe6xl4nMSMntPbrmFhhDaNoM4T9ifQSJEhN60wXfICL6k+4Nxx:nZxlsMiFhWFQ9iJPxXfI9EF

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2