Extracted

• • Target

    2d472944cce2a1a6664c29336004f22c

  • Size

    998KB

  • MD5

    2d472944cce2a1a6664c29336004f22c

  • SHA1

    2d88407509c184f6ea85f81910f4c81dc118499b

  • SHA256

    5abec5e92048d2cf64785ed4a873acc4fd88be7d361e47b5508753bd43eeafb2

  • SHA512

    b4d24ccd5a345fbcd845b7cb4176bb23e5bc42a8e1e4302ba7d2a4c67864ff7e266351e3910ba32eb4799159e3c35d7465cb4fa6fe4324255b82bed377f21cf1

  • SSDEEP

    24576:JoFGjUhRm/dFgaK64E3MyOvAcamEe/aNF0ZoR:CFk69aK6443OYO0Noc

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2