Extracted

• • Target

    51931aa78a7fa407f633245c4196dcd9

  • Size

    389KB

  • MD5

    51931aa78a7fa407f633245c4196dcd9

  • SHA1

    a135867604c315443e28a6c133e8fb44e0aab418

  • SHA256

    d0aec3e725b495f946828fa65d5bcbc003a0adf1bc056f14a2a0ee8355076644

  • SHA512

    087802fbbecdbc8e1ba86411e068f3c53a04e88bcab632ac62cc63e4d4d020eba190f4d2f27f690888d0b2371ef3fa2986b7d7330f10a5dd19628f9c093d7223

  • SSDEEP

    12288:MnhYfq+LHU07XrEdrH9DxtNC3shCl3T/Hke:Mnhe7USrIdDEsEl3DHl

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2