Extracted

• • Target

    1c30f9a583d4b2dc406b2b5a187bc042b535025b76e1983470e9f18309a17c8c.exe

  • Size

    1.0MB

  • MD5

    f5cb8e84f3124c37b0a275944be5c54c

  • SHA1

    99bc68609d1da7fce3e1b7e39c0b6388b089305f

  • SHA256

    1c30f9a583d4b2dc406b2b5a187bc042b535025b76e1983470e9f18309a17c8c

  • SHA512

    616cee6ee6cad22a99567fc3e3d97e78eb921cc8af549eace9d2542431077b952d88ed87d5e3a9880525cbbdc5faddbb6d9bb2f5d450733ec1a3b3e95a118626

  • SSDEEP

    24576:pRmJkcoQricOIQxiZY1iaaje+6aSItiIbeQ8w1eoZ:mJZoQrbTFZY1iaiL6aPtHEP8

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2