Extracted

• • Target

    2efb7a094b303bdb0caf62dd8d676963

  • Size

    844KB

  • MD5

    2efb7a094b303bdb0caf62dd8d676963

  • SHA1

    70a4fdaff3eb7dcefe8b472a515341ad216c2e49

  • SHA256

    14b33650cf6497ab5a9f973f61ca8b43ad33a0b1a85f378345f51855567f4d2a

  • SHA512

    5f930d4be2c259a40ec1abf2102124e36f2c17f2026ee5d23b868e9ea9c5efeee17e09eb955d2594bcaa668778d5ff00c6d2950935802e370ab99f32af42d6b9

  • SSDEEP

    12288:b2VrmcC2EsNa7iS/d348n0PhybuVj5T8h7GzULMMENOvgfXtUKA4qX:MrzVhlS/d3j6Vj5ghp2NOYqKS

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2