Extracted

• • Target

    822a424b469a4aec464f209d49dd072f.exe

  • Size

    949KB

  • MD5

    822a424b469a4aec464f209d49dd072f

  • SHA1

    67745d9c1f41b590f8cd2d376eaf11e7d07ff72c

  • SHA256

    859d05f0772aea7288798439bf948694e3d8f2636fadca063814659db5635a48

  • SHA512

    62492a6438cdfa94e0e1d6dc0b493a6ff234faf7f4ef9e27d6822729115a9d0224a19558915cdb883570cf73363bbb404a9a75bbe9a15e7e998102e46eff8a4a

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLEHMp2bvk18/a61HX7:f3v+7/5QLKvke/a6J7

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2