Extracted

• • Target

    c6157a2d8929ee7b7305c506b90232b6

  • Size

    797KB

  • MD5

    c6157a2d8929ee7b7305c506b90232b6

  • SHA1

    4f7006625274cfdb3523dd186235f48bd3861406

  • SHA256

    5d04e3c385baf9cf26f9805fd3739151de1549704f6701132e20787e2c195fa2

  • SHA512

    ca6306fcfb703dc4a7a0b36062ec2a52121516bcc32590de2dba24b60597e027a56d0fc927bee5be7dfb611eac2ef4d0fdd7c9be1171b55f636980ea19ee74c1

  • SSDEEP

    12288:QWDc9F3nC0Py3gAhMIYO2nyCRd2ROKRi82zR3VgZP7ZZhLCDdX8IyPumD:QzVOmyUlR82zRFePxsx0

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2