Extracted

• • Target

    e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe

  • Size

    2.0MB

  • MD5

    f107093ca8c59b80610b4169011e191b

  • SHA1

    92c71dd5a306556b5e114bc044dce66672bf5dbd

  • SHA256

    e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4

  • SHA512

    4474bdba442d64fb680b36cbfd8c75c66287fb2643d0f869ef087799d5388b16d7422bf4f9049258bb325678966763c038dae69268172dcde03fcf21701ef651

  • SSDEEP

    12288:m6G6SmMovrikZH/IOxg5p6Z0PuHufm4to544VmxSfXwPzWwPW:V/MoD5VOBnLW

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2