Extracted

• • Target

    922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe

  • Size

    353KB

  • MD5

    631691dca7abc573a0cc911b2ddca40e

  • SHA1

    0ddc497bb233cda946e320378cde5e5cc507eb72

  • SHA256

    922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859

  • SHA512

    4a94910b35a95038ba787095970ee32281011021f3cd33066bc8b350c2b1824e1f67a303492fbaae41e9872e75667325e3a4b8d759dce3a79105a00a09782dd9

  • SSDEEP

    768:BiHqbOcbd5LGOcccCM8AMx9m24IeGFfRhQg2ZzEjss2VSg1I1cn0sspAgpq8hLy8:oHqbbJGwrThRhQ7qPpqOLy0uyL+fS

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2