Extracted

• • Target

    8f44201b56398e30425dab3f99cda8c490e3b4ded5f8d545de18f779f1feb6e9.exe

  • Size

    772KB

  • MD5

    d064646721e6e070b61daecc9396bd63

  • SHA1

    aa6194967f091d6ad78ee72b937dde20a89fcfb9

  • SHA256

    8f44201b56398e30425dab3f99cda8c490e3b4ded5f8d545de18f779f1feb6e9

  • SHA512

    b3eaedec7c2007a0fc5f1ce3d726a13bc9a69d6dbcd1f2db05a7db023917a02f533626a1c79648d613f014c17b358d70fb714b1939bd329d01113f0348bcbbd1

  • SSDEEP

    12288:dJpHCmbibyjK567+fJzJjIOppNcTB+iIPsMI:ZCtyjK5QyJjIGpNcT+P

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2