Extracted

• • Target

    72a57e3d9f14e359269a8113470745a8

  • Size

    1.3MB

  • MD5

    72a57e3d9f14e359269a8113470745a8

  • SHA1

    140eeea760474fddb26e04502ff96ff4fcd65f67

  • SHA256

    ff5abc60e15112911bb21f34f1a80d361c7498fff1edb9b4c8732e305f196003

  • SHA512

    3b1fee9606febba0ae0906f2553a3030c2373c11323b97edd84f1f0de4f3601fb2d5665e33f5d4f404f6c4790026c87e115a4ff61655cfecb8ef6081d517847f

  • SSDEEP

    24576:MucTgqmcEXG4P85OiEzkwg54Vys89UrmMnfk/iQ2+S0d:M7gBcEXGjOiOrPysaU9fk/Pj

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2