Extracted

• • Target

    c7a131685f4235140da8b3310a3d1816527268ba1cd788b24e5011b572eaf9a3.exe

  • Size

    553KB

  • MD5

    4b6a4185deab6ab773c385544348ad2d

  • SHA1

    063ce8ac9989d729ee476f05dc4b4ca0e4683d36

  • SHA256

    c7a131685f4235140da8b3310a3d1816527268ba1cd788b24e5011b572eaf9a3

  • SHA512

    0a79a552bebef3006492e3501458222d099c5968599e819827dce321872da2cce1a1fcaf7d603c96083c9214671f35dac6fcd63a98871f74ce61bab8b9cdf6ea

  • SSDEEP

    12288:T6Z6wR7njY2nH1TjZhqxXo7qyzTwHHyxeB7nk80OS:mZ6wNjLHBj7qxXoGQwHHrBTF

  Score

  10^/10

  snakekeyloggerdiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2