Extracted

• • Target

    cc29764f5e01f950b0db52e5caac83b448fda9e7defacf1a9a19a7e4aa96757e.exe

  • Size

    979KB

  • MD5

    9acdf190d911622ddf291d009bbfc43d

  • SHA1

    0bc2ca1851c17cdef12194a9e9a61fc37c7f1532

  • SHA256

    cc29764f5e01f950b0db52e5caac83b448fda9e7defacf1a9a19a7e4aa96757e

  • SHA512

    38dc41d16603917c69095076652af0fb8c88e3b34a4d458db7c14f9df30011132d533787b6f2ee413bc323443cff617c19666caeab95590bc7fface8204c13cc

  • SSDEEP

    12288:CRLIA/zRcb5HkSGG60AEyUpiHRb9Jx6ZBkZkHni5Z+CxDIhUIYJyGMXD:CRLIGcb5/O9oixbIkZI2I6AGMXD

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables with potential process hoocking

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2