Extracted

• • Target

    9b59cf1e6991964af85280afc3c850b3e42164e2ad12a460ed80695242be568e.exe

  • Size

    464KB

  • MD5

    33b3a84329888a084a88712bbf7243a0

  • SHA1

    8f74801de3966b0fccd22164a53e92574cce26e7

  • SHA256

    9b59cf1e6991964af85280afc3c850b3e42164e2ad12a460ed80695242be568e

  • SHA512

    929e28985a7e9053fae9bb71b8e7e70599765d1111b1fe0ba5574862081f38c214ff125e8dec49ac2082891343f89a0f93af603c01d9f3a6b3f0a1326ccf6229

  • SSDEEP

    6144:rvCIIwryDMr/hTYf3yPxAUy8HqN4DH3fA09878ktKMMsbiGx3XnUzG9ZfhRwm:rCXn4wGxJyLw3f587rMsln3f

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2