Extracted

• • Target

    [[-Domain-]] INV#09SPI.exe

  • Size

    942KB

  • MD5

    5c10967b59a71f6a98598350c49cc44b

  • SHA1

    27a239efb62d33a5f70c8bf1759b7a81349d88b8

  • SHA256

    3bd91515dfd11609bbac1c83dabdf5caede5c7556fb4f3823de320aa117af86b

  • SHA512

    113a637cbef3b5137568523285ec654f273105c5339483831f7167488c7ff403a92e15036f94390c8c03a2921b580e7c2076ad5ae8c1685e8b4e65e5e86e9fc6

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaCYcFJspLKDmG:7JZoQrbTFZY1iaCYcbsp0

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2