Extracted

• • Target
    7f10244723a1708686bb1fb39c9832ac40ce5222cfb8bac5297b15034629ed58.exe
  • Size 588KB
  • SHA256 7f10244723a1708686bb1fb39c9832ac40ce5222cfb8bac5297b15034629ed58
  • MD5 fc7fa4f4fb4426427384e041bac39740
  • SHA1 e74d7af541c85d2ac76ca209d731205aa263d227
  • SHA512 b37fbbb462a7132b6c94075871f1106470079932dd2d6a6949e4665e04a3a7bc26ab111e75df0bb4412a14cdddbbc71a50afa59b81dc99db9ae2ca4a6e127c8c
  • SSDEEP 12288:4TeH81jJU4bsIm3uQXoZebor77KrosQFQgPzxdMTz:r8M4bsN7XoYbqKrMFQgPzx2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables with potential process hoocking

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2