Extracted

• • Target

    dc0c3587015bbc6fc02f6a9adc3080243a6750b4be47bff2a817b730ee6f67e4.exe

  • Size

    2.4MB

  • MD5

    570c77d90e5a96486048e52c78eb3688

  • SHA1

    fd641bbf38f52d6b249e39d00fcf1a541422732a

  • SHA256

    dc0c3587015bbc6fc02f6a9adc3080243a6750b4be47bff2a817b730ee6f67e4

  • SHA512

    1bbcda143deaa12e77bd3cbe314309905d1eef946ecbaba42f4dc43d4b548b010058d6aa66e409dd8fddb7efb8e2b66914e6bc2a90c44047d97cba7f0b83dd5d

  • SSDEEP

    6144:8sUu/OLgfh0KcFUgcGuvP/S2yPzDvEOcfpbiza5zdJR6B0d/FxRe2FUUEtiecHXd:8hwOih0Ki8varDMOchbiIR80xNPXVe1K

  Score

  10^/10

  snakekeyloggerdiscoveryevasionexecutionkeyloggerstealertrojan

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2