Extracted

• • Target

    88137ef5ca05130558e846da3d480008f2e5488a7543872195f64daa5a04b365.exe

  • Size

    459KB

  • MD5

    8ad01c64b357780c078e44780c322600

  • SHA1

    a016f5f6ff8a89557e34b5e5173dfc8a9a50b6ab

  • SHA256

    88137ef5ca05130558e846da3d480008f2e5488a7543872195f64daa5a04b365

  • SHA512

    e1d0a7c2749b1f06fa22c8f0a3b134f8220b9c4898e8af9d7c1ee33567f07d245f606ddb74e02afa71c7f4076051afb1c99f72f5d47da2efa1ed5534a1de825d

  • SSDEEP

    6144:q+hiQ1o1emq43RaLJM5hp8Sp1YX7RdE66hYM30mztCiLAzvmBsOuRLX3+0Wtz6t0:74ZqGhF7uidhYM7COQvmBsOeetyAQF

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2