Extracted

• • Target

    cd1effaef2ebe53cb120fc308084bf8ccdbf9b57e7f0dc5a88af5a372f8721d6N

  • Size

    1.1MB

  • MD5

    7be52418abfdaaaf10ce3445743342e0

  • SHA1

    8382b66c7f96fd1412e61c177b6d4ec86363e684

  • SHA256

    cd1effaef2ebe53cb120fc308084bf8ccdbf9b57e7f0dc5a88af5a372f8721d6

  • SHA512

    e5a918fc70965c63b2e379bf3cf03adf2cfb6fbf582f41bec1c490e435751416f804c331b56b3eb35c50bafb23947f0fd0c1a967019b246ec0a8e154fdfde0b5

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLI4Myrq0nGR2O12tKUqxdMT3Bib:f3v+7/5QLs5qO2jKGDq

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2