Extracted

• • Target

    21defeecddcd60f6dd2fb4efc93503f1ff759cf81dc3429d8cff40f9977b3d6c.exe

  • Size

    670KB

  • MD5

    f8be25a014b6d2c4ef534e685ec9a327

  • SHA1

    391a5b2f1a5d669e9c0c0377dd5c0f0063123c6f

  • SHA256

    21defeecddcd60f6dd2fb4efc93503f1ff759cf81dc3429d8cff40f9977b3d6c

  • SHA512

    d9a33afb966eb9ad60a764b609e3164ee81bc84f1fadcb40a3bcd7b1f1c745dfc306e400b5ce5fd3f5ae63515872217478d50add287bd54c7e7eaba581567050

  • SSDEEP

    12288:xYV6MorX7qzuC3QHO9FQVHPF51jgcEjBnmK0Sw06ogk2feu2yQcKr5ROdY:GBXu9HGaVHGrwiOfeuhQHOm

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealerupx

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2