Extracted

• • Target

    Ref_0160_0782.exe

  • Size

    102KB

  • MD5

    ea6421e2c475a88353aff4aef00dfd3a

  • SHA1

    055bcef3e98729d5515ba1e34d30977b28fcba58

  • SHA256

    cc353b50dbbf45b7c931885450e2a1033135b0b59daf5720b5a98f2941a5038e

  • SHA512

    f515e5a587951840dd1f76003804f4edc4f0379d370c9e372e21d811bdc07e935ea593cf5e046f1d6c70d78a409fc5b4a5832dc84ad9fa90c84af35138770c91

  • SSDEEP

    3072:Q8ISVIPM8mI8yrQeT9YFDaNUTTYR0iyW88Sv7KU/s:Q8lVIPM8R8yXT9saNOTYR588Se9

  Score

  10^/10

  discoverypersistencesnakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2