Extracted

• • Target

    49d00fbb783d0a1f50039699bb9e0e3a

  • Size

    600KB

  • MD5

    49d00fbb783d0a1f50039699bb9e0e3a

  • SHA1

    d37b84415b0619497c7786e6d1db1883c071e0d3

  • SHA256

    7bb173d6f12fefce48a6a3f2ec2d2e73bab1a1fc3c7a8f1fed35694a4053953f

  • SHA512

    1b4a3cb9a632a4c91600f700a829f107608bffae26a1457fee8595bb74e3c7506586c607975b2802709a297af918c880b6c762ca1d628bc20d9ef9206f194448

  • SSDEEP

    12288:lYiPU9nPU9aOZFH0PiDRs2OsBgo0q4wMD1cGXdr6m6sD9Whu0QaxIpbj2XYpOZ:lYARs2OsBgo0q4wMDedW9+Q7p1pq

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2