Extracted

• • Target

    720d562193e2cc463b620790899c49f68ff6e465e717ccd13660c042eb7e0d1b.exe

  • Size

    942KB

  • MD5

    4cec7d122305781fa5e0ba0704829f2a

  • SHA1

    07a683068ef2f486e4e2637a7564a15da9438c56

  • SHA256

    720d562193e2cc463b620790899c49f68ff6e465e717ccd13660c042eb7e0d1b

  • SHA512

    a5eb196b50eea115ce1323983fcf8bfd8a4dda455432b8179a9f73acc14331372eb51be5d62a81ea4614bc5a4d66ae1929572f8cde7bddb21c039c8ffb49e432

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaChH7ITx0h1tTG68GDe:7JZoQrbTFZY1iaCF7ITCiZ

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2