Extracted

• • Target

    03e0c87acbd555226e4510cb8e5034f5

  • Size

    1.5MB

  • MD5

    03e0c87acbd555226e4510cb8e5034f5

  • SHA1

    7cae7eb46c366fe9a9f72fadb91abe7386fd4d00

  • SHA256

    d0ff1050e74986eb30da03e8de2b8d6d9300836849615521c40520def4916473

  • SHA512

    0938dbe7d04914ab5888061e56065688acc3d0120f88e981a8f0639d994866d88643e84a41cf109347e2344c3dbc2baa5bcdd15f467f5048e77317f102306a20

  • SSDEEP

    24576:1yhXW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+huR:o0iecHCNvP8EOShNQuiNB/e

  Score

  10^/10

  snakekeyloggerevasionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2