Extracted

• • Target

    dd04b002364ba4c2bfa9ee34465bc23c

  • Size

    556KB

  • MD5

    dd04b002364ba4c2bfa9ee34465bc23c

  • SHA1

    55d515d1b98e4024aa00e87630340adb7f7b9603

  • SHA256

    0138e060a226925970f5b9488babd201daa2968bada87a281732a701c6da8789

  • SHA512

    fa2bdd79322ace4a7ac85f00aedfa0e86b0eccd9ac41bd4c87fd22d53e0ff399e0316ea6e7c635992c82b8a2cfad8d58d3799cbf930c04c172d74dc4e831f849

  • SSDEEP

    12288:wcP3/Awk/7iS/d348sJTflM6qTwz9FhC5lruNjkDUcv:wkAwkuS/d3kTfm6qTwJKYj4/

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2