Extracted

• • Target
    f8aa18d4254a618c058dda0a2be332707f305795953a26402e7b5f791b778bf0.exe
  • Size 389KB
  • SHA256 f8aa18d4254a618c058dda0a2be332707f305795953a26402e7b5f791b778bf0
  • MD5 016b555049364f09f3d2f58fe88c28f7
  • SHA1 48893b18559daa8392ff371117f799113c81c90d
  • SHA512 15ce409cdb879c30d14d6211127fa0d8f7cc22611b3c20906f70ef5da059dd769953441e4cd466b2b6c3f7a6124786f0c6f981abc75812f2a99d452bd1d3d586
  • SSDEEP 6144:9M23AbpBWzrsx8NjZc+2xFLHUxxf5WMG8FtObeYv5JuvWLWC32jTMA3hJCQNUs:vGpQzQ8cLxFQtdG8Ftqvzh9pKJfNb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  snakekeyloggercollectionexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2