Extracted

• • Target

    69bf702d9534362c01ef68fc6fab10c1

  • Size

    324KB

  • MD5

    69bf702d9534362c01ef68fc6fab10c1

  • SHA1

    495644930cedd710c37bdc69c931b5333f147d41

  • SHA256

    6bfde0abeab045d2ea80c8f46415b00ac74911b23a98b6e72d66ce7fafdec5d6

  • SHA512

    00a1ff43107dd264168af64a924b0b3f9441d9c44ce3f530705c93b59933d8d7126613c23d039ed71f5f5cec5bb2fcf47add7f88241c94c52bb12917af479c22

  • SSDEEP

    6144:b8LxBBXsxvRKsSNhaI8oS81aLE7IpB3P+G7W3yt2YjDvAw:ysxJKsSNknoSU4pB3GuvLAw

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2