Extracted

• • Target

    56c7b310c12b8d5d71b358ff658508605a1c7aa7b3d0b84a69ac41efcbf38e07.exe

  • Size

    572KB

  • MD5

    d8a3d7c36537448c74f75893e9bc1102

  • SHA1

    df9f16cd2b39624aec807b470b0d05e1755f2b83

  • SHA256

    56c7b310c12b8d5d71b358ff658508605a1c7aa7b3d0b84a69ac41efcbf38e07

  • SHA512

    87fce31b07f3b3073f35eb1ebb909f6734207281487ab06975b2b14924711b82c08ed092691a43e4e38e2a2fc315acbb270b0793dbc9927a8e06833b6940d1ad

  • SSDEEP

    12288:VJRSTgjxPhqRg/Gt84q/gpCcDlEexNg3aWFQl8ZM2jfodGEVQb4Ce:ZSMjeEexeqYQY7GCe

  Score

  10^/10

  discoverypersistencesnakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2