Extracted

• • Target

    139d42abb395bab309612cb3bd31b4bd

  • Size

    439KB

  • MD5

    139d42abb395bab309612cb3bd31b4bd

  • SHA1

    12173902ddd86e520055c09c2ec33528bd272411

  • SHA256

    1b7416ccd14d77c3e32acd8de94d7a3e41d7c615ce2fe04ab9254025fade1464

  • SHA512

    7610c136ea0a5fcab3e1529d9c4b87e875db3bd55ed5ff185c6c075b844ced8a94b0aaa7bcb929ada80d5970ded2384d9dc061f0eeda1ee12c95b048422039db

  • SSDEEP

    12288:Vf1cG+DGoqS09iJOCDyjqkoocU9rF0vdSPntqW5B:vDGlJOljvoC9rGvIPntzB

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2