Extracted

• • Target

    taskhostw.exe

  • Size

    931KB

  • MD5

    58ff14d476f2bbaab31b12587c09559e

  • SHA1

    ea9c7ce65a67f2a2d4e1ca4a2c3ac6785021fc94

  • SHA256

    1640e87780b219eba703c734e68b0f5cf793bc94fe0cdf9121658d12bb1f9364

  • SHA512

    a75d4bd80620a9441783131812780397fb0c3b1c6d6b9147d65ece23d9cc9384c148f6c491794cfbc012c290e3266e06a76357b84141b843929a295c2649613a

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLiFrZo5cPsD+tOM5m4dxEMP:f3v+7/5QLiFrZycPBOP6Eg

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2