Extracted

• • Target
    3d42be817eb0a150a642713d3234847e943dce60e98a3e9722d9fa01d5c880c4.exe
  • Size 610KB
  • SHA256 3d42be817eb0a150a642713d3234847e943dce60e98a3e9722d9fa01d5c880c4
  • MD5 d8daf5dd7816250aa778a6f83f073d69
  • SHA1 d973e49364a31c2fa86479b17aaafd80815f49a8
  • SHA512 0a116ed046e19a8295bdc23e9d9bfd0b6a368cf5b0da4a1dc5b4f36cb2a3c573e8f2645746ae838c818b3110fbe43e23825ac5a341dbe91fb77216db8754d280
  • SSDEEP 12288:WX0pei36RjV6aCKe11pI/zObuJV5DSUG3mfj0rkG/FCRuz:Wkpp363D01eRj5DSUIm7qHP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggerexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2