Extracted

• • Target

    4e3ce2b9ea3993247024c3913a8f3369.exe

  • Size

    425KB

  • MD5

    4e3ce2b9ea3993247024c3913a8f3369

  • SHA1

    6273109c8440c8b6c9b1bda2d2b2aae30092b354

  • SHA256

    4441fad80f7d9fe2461493e477970b92de305aef708c5e2b2429ba8b69ffb0d5

  • SHA512

    054d2fe3a9fdc79f298478578c8e57fdb8bdfcca679d06ca63bbe1ff1886f5406b606aaede5a7c0e1426f5ae633dcc1a0292119f08e76d8694c333088a59ac37

  • SSDEEP

    6144:knos4KBOPy/doBi5d9e3OuFxbfeFJEBT3GisfoEVdPt+7pOSUHpvOG+E6TXoW2u9:FYf9eGSEVBtoPWvOCSoP5Gsvg2yyor

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2