Extracted

• • Target

    131fe66006df3d7031088f28a1aaff46

  • Size

    767KB

  • MD5

    131fe66006df3d7031088f28a1aaff46

  • SHA1

    ddec6964f217b637dccd3ff9c650a9bab236a190

  • SHA256

    640f83432d70d60b4449d65dc39474e50f934134f30a12487fc620ecda43c556

  • SHA512

    d613909aac7d2dfb04230ea27c50ce1fcc530367edf2cb6de4c93caeeff0babb5663d33eb6de8df14a66ec0e61881310053f5d893dd96499511f89c60dc66b89

  • SSDEEP

    12288:zcomEX7qKt121mFTwu99ACMPRGJhWYensuxwXCTZYadYmd+xVdjbRZwVWQVri+IQ:oomEXf1Sg1tMZGJk9xwnaeKow7mo5oFY

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2