Extracted

• • Target

    1ebc0bc6e88c2f8ae455a8c250a87093

  • Size

    548KB

  • MD5

    1ebc0bc6e88c2f8ae455a8c250a87093

  • SHA1

    cee7806eee5d4e6dbf4a04f099e8994b23118349

  • SHA256

    2f42e126439842a833e37d5ac5a925975aeb2d9f2d39eb3579dd25d7eabf9b58

  • SHA512

    a104f47befc39aab32e431febe5393267229def0143915f52385f913e6303582641e40e165cdecaa97334ca356567388fd1372ad036e83fc94bc48ae40416709

  • SSDEEP

    12288:ffg2HEh0MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM+MMMMMMMMMMMMMMMMMMMMMW:Q2tMMMMMMMMMMMMMMMMMMMMMMMMMMMM5

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2