Extracted

• • Target

    dd3a52585c2603476b5fb647d3b6bbce

  • Size

    1.1MB

  • MD5

    dd3a52585c2603476b5fb647d3b6bbce

  • SHA1

    fa151caa6c0f905c046dd94512807bb29fdb3fb9

  • SHA256

    64c9a9351771d678aa64e80453e7310b25b48458d64f7e34d98a36a2084bfe0e

  • SHA512

    8c91de0a2e6faf47cca410337015123fddc9909c28cfc760ad998faefc822bd7cf0cca43633017faabe0921a6205d3a1ef86eed0630d887a5c911f728d90ad22

  • SSDEEP

    24576:/kwOsBgo0q4wMMBmCmTOUd+L6k5XWuZB6gQ0AnQK7cKRe:8xoHMUmCm6Ud+z5XhZCQKfRe

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2