Extracted

• • Target

    6fabfce57e7c8674b37429eb9afec068608eec31f20c2b085a4b63c7f77873a1.exe

  • Size

    963KB

  • MD5

    5341cd0c95c935a73c2d3a3fb31db093

  • SHA1

    d2601f228938666674d5e6242d2b96c14ea98e51

  • SHA256

    6fabfce57e7c8674b37429eb9afec068608eec31f20c2b085a4b63c7f77873a1

  • SHA512

    37a627d82b0a7cb904ad2db75f4ce3ca3e71cfced8a8902569d32c963e042c34945df27cf27052e87cb452719c58220c71830398c12e7b72184d76adcc677f8d

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaChCsijnnapIz7E:7JZoQrbTFZY1iaCQJapI8

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2