Extracted

• • Target

    malw.exe

  • Size

    954KB

  • MD5

    c8379e68ab86d95f8f5325e95343194c

  • SHA1

    72aaaf274c5b13c8b05cbf10db52580c9201811a

  • SHA256

    51db24ea281866cd0b7354b927198f4df35020df5a84dd66d64dc524421773ae

  • SHA512

    cc48de82e88e50d2e4b2d420d3d242cb46ce4e9e355e7d662bb3f2bd7a66bcdebb0c57ec9d5c3121a9297f4ea3d1bbed46a35276376b773cbcc9fb4fae7edb7b

  • SSDEEP

    24576:iqQvaIDEiGUbwU+avF0NIOB+WrqYwt8xc5yhW1ylAcCpW:RIBG2+AF6Rq19I7

  Score

  10^/10

  discoverypersistencesnakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2