Extracted

• • Target

    8999062d9e50185bc7931727064d1dde95df131c2b6e860b71ee39da284e3219.exe

  • Size

    638KB

  • MD5

    450d93e49d2b68dbc1321e044e018eec

  • SHA1

    54cdee25e2c79fa88208d4b7e5848c4d9f99f053

  • SHA256

    8999062d9e50185bc7931727064d1dde95df131c2b6e860b71ee39da284e3219

  • SHA512

    63bb49a112aa03c33d1c4736d90d3473e23fb83f76c706e6f3251d1627b6d22fef7013f6536283001ef667199cc589521ce476247aad8f9bc4907f1bcc8f53a7

  • SSDEEP

    12288:WTPF847SX3pdFRtoXyLAz68Q6awWLMoyo/0xJzWZAhj:WTd82SXRRIyaQ6aw7WMxYAhj

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2