Extracted

• • Target

    ca3a3bfe5fa34b3d8036d1f3465654d604faf89c914f808c40fa7fa506181adb.exe

  • Size

    954KB

  • MD5

    0739fac7999ca876722fb5500f68ad28

  • SHA1

    c0dd8304902264cb15fc11f9a77310ddf646c3c6

  • SHA256

    ca3a3bfe5fa34b3d8036d1f3465654d604faf89c914f808c40fa7fa506181adb

  • SHA512

    cb6e9fdbeca08360b5f37a023f8a0526e288c4141e9c10f0944e91a5c30464d124176030d901c75af8c8fc3b6a10648746f648dcea9411eeb59ad5fde3249c86

  • SSDEEP

    24576:iqQvaIDEiGUbwU+avF0NIOB+WrqYwt8xc5yhW1ylAcCpW:RIBG2+AF6Rq19I7

  Score

  10^/10

  discoverypersistencesnakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2