Extracted

• • Target

    42e9e8bca35f196255046a9640873a31

  • Size

    844KB

  • MD5

    42e9e8bca35f196255046a9640873a31

  • SHA1

    ac5449f53111107fc6d73e2fcf7125dfd1ea94fc

  • SHA256

    915e92b462c184dbe68f5c21fb0843e802969b7a3f20d30095e485e892c7a818

  • SHA512

    e290ce98b223ef791236538dec71a12e8448b5aeb54b4bcdbc16114fda279a7cdd422017846e2b934ab8ed80ec9e025ebe5b4c091c30a41e9441a7bcb22a5cb3

  • SSDEEP

    12288:Y6fftwLUW/hy7iS/d348nf9dgtOn16eqfg4OAlE+qmUu3AdqZBXRqvt0/BCh2Tne:3tup9S/d3r+8n1IjUu3A00vt0u2zK

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2