Extracted

• • Target

    334c0820434d474ffc6d7347f8c27697

  • Size

    574KB

  • MD5

    334c0820434d474ffc6d7347f8c27697

  • SHA1

    f0af5e6bb35f3b10f26386f4ad77db78ed0b4a72

  • SHA256

    1aa71ccdef644e05966553af027e6434454c8e76a1e04522a7ad2da789d8f248

  • SHA512

    8deaec055e232565d30de462082245d1d4967de1777e4d22d8969a017022da2479af029e37674c4a31d6aee1961e9b00f69808c6cf0d7a0f150a474ee2ff5d64

  • SSDEEP

    12288:WapTqZxyRlYoeibexh9mu+02dG0cMBxo/c7mo5oFCEkv:WiTqfyRuoFbC8j0sG0J7mo5oFCEkv

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2