Extracted

• • Target

    2c2278d30f145b813ad9eafe8fcc77ed6cb35679b136221974f708e943a2afaf.exe

  • Size

    63KB

  • MD5

    3e40d63b33b3b8b4fca874063dfde5ad

  • SHA1

    47fb479bf0ae34e3a08a2f93666136fbfb96c3a7

  • SHA256

    2c2278d30f145b813ad9eafe8fcc77ed6cb35679b136221974f708e943a2afaf

  • SHA512

    0bd2efe7a91f0b929273769908979b6dfc62a24489f4618252af1aaac177b4b45eaf0bbf0a10c1a8b97f5a362f3a91df70da0318466f7512e8155eb9e76d7170

  • SSDEEP

    1536:WKUfn1ZeSPcCKP8DOEAV2xzzmmhjiLf88Ju5ZE62:NUP1ZRcCKubbemhjib85E62

  Score

  10^/10

  discoverysnakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2