Extracted

• • Target

    419db1713ddee532f072f5edf931c640

  • Size

    376KB

  • MD5

    419db1713ddee532f072f5edf931c640

  • SHA1

    ba6043b7799b5aa56f5dd26796404694f3e17eb4

  • SHA256

    8fad14859c263fb5994f3b3fb79fce9c3d62479f5794a4a404cc4c5ea506181f

  • SHA512

    7384a654b0c099ac8ce108aec11a4707027c817c61e918b8597c8c2da01469d03c20445863ee7807b11d2cdc6c3a20c7a52d61afc5c08f92da564011ac9228dc

  • SSDEEP

    6144:EJI91rQAN1zbK9j3/gOoIUQDgsoMWF5YBC7W0nnpvdKGIXPDEOvNE/Al2AU5lwtC:nXC/DzpssfmmBC7WqVKGIXPQuE/AQAU9

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2