Extracted

• • Target

    83cc76639224b1e78e15480cd1911474c28224ac39a72cd1ffd85aca400fcf44.exe

  • Size

    2.6MB

  • MD5

    3e1f185aa42c5d7b275355e2d78c6365

  • SHA1

    3f499d7ac948a1da5c5298c158d265264d506a64

  • SHA256

    83cc76639224b1e78e15480cd1911474c28224ac39a72cd1ffd85aca400fcf44

  • SHA512

    4babb114f964bf2533bd4f65e2f33b0f2beedae89628e864c950f9c546b9738ff034d6dc5fb1dcd36868b701e535d17e9592efee2b97b11e2ca4389668865305

  • SSDEEP

    49152:V1DrRvqVae63Uss55oN1C5Urhx0wFWXZlXvK4iIW/Wm8oCubZe+cw:V7qAc5o0YcwQXTtSWmTbZOw

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerpersistencestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2