Extracted

• • Target

    fa68e5958fbbc8a96dfddaa28cce6dae0fc52905571b55731f07464e4642627c

  • Size

    1.2MB

  • MD5

    8277ca0e3f3c1dd755870b6a166e1276

  • SHA1

    fbd7818d3c9be9781e4da7724cab928cc3c25555

  • SHA256

    fa68e5958fbbc8a96dfddaa28cce6dae0fc52905571b55731f07464e4642627c

  • SHA512

    100c9d45e54fe57032f0d1ad3111ffc5b0e539ec248baefe4eccb261ef76a42ccdce2f81bb9ab8a39fcf58797dabc5c54804bbfd0a44a65ee2612f9277c708a9

  • SSDEEP

    24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8azqNcenjPZIeoZulEFJs:ZTvC/MTQYxsWR7azsxISlI

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2