Extracted

• • Target

    rPayment_slip.exe

  • Size

    969KB

  • MD5

    743ab8e823bb4d5fafa96b6334c0ce4d

  • SHA1

    61982f5dda24433c87ed4c24e9f9261c115d84ed

  • SHA256

    74016b927469a965edfc8bfb29d943b08f71cf2e4b6e756d739b1e926c859439

  • SHA512

    b9c6ad2f627c2889af8ce4f88956e68d9433eac82217f944f1c6a59a1e50689245792e1ddfdf68c9b1f8b3637ecff22abffebcb43346cdc2443babab6d8bbe06

  • SSDEEP

    12288:ALkcoxg7v3qnC11ErwIhh0F4qwUgUny5QYEAmD4M+4x88WncL51fG9hcGTa:WfmMv6Ckr7Mny5QYjY88WcNL0a

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2