Extracted

Extracted

• • Target

    8248df24bfd99d9869ec94c4d3321b61171a3c5137921bdd254e40118c50d0b7.exe

  • Size

    949KB

  • MD5

    d5b3d11c19dcb6e3125415c0dedfe2b6

  • SHA1

    f4c8309c80c85b8d1316fb88a90102d81c3474fd

  • SHA256

    8248df24bfd99d9869ec94c4d3321b61171a3c5137921bdd254e40118c50d0b7

  • SHA512

    d1e9e87e82a29c4d24bc2ea25740032b93af7ee048309c9ed2e249578dca8b7558fe561fb25ec22eeceea62fb2b05607fad6c5eff724657612f12dc109f3f107

  • SSDEEP

    12288:CDN+hU6YasBZbnT9pf0K+Dg0I6d3oxs0P3hCYbVVUhyeb5zXre:CfBZbnJFx+Dp2FUjVz6

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2