Extracted

• • Target

    cbc7aacb22ac144ca5f15c78466dca24

  • Size

    569KB

  • MD5

    cbc7aacb22ac144ca5f15c78466dca24

  • SHA1

    caa3b098f36c5e5821c7411ebd401611e96822cb

  • SHA256

    68f31e476ab5d2024565f79f7576831a94a232e27a20a1fbe9e6ced3d4056263

  • SHA512

    2f858d912efaf7c60bd5d2cec9a59fe68620ac9d62d3b80e828a119efcd4a9cfcf0048a7129a3e101acc03a70297a3f284c53cc37129d8559db9a526623ddaf9

  • SSDEEP

    12288:oXe9PPlowWX0t6mOQwg1Qd15CcYk0We13hjuI+NVsH9h775lmVHLI7nk:lhloDX0XOf4Hm0z7SHcQ

  Score

  10^/10

  upxsnakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2