Extracted

• • Target

    1bad301dc6bc6e3ebda9398dc725cc09

  • Size

    955KB

  • MD5

    1bad301dc6bc6e3ebda9398dc725cc09

  • SHA1

    f0bd08347b10015e8fb5b3947ac5ed29c76bf3b0

  • SHA256

    b6d1c9c00367ad125a2a658201e70bbe8fb02890e29d1d595e6d1a5755220e99

  • SHA512

    e5c833c046d1648dcd53ee6009317940953448d8db6fe086e3c38a4afd299b66b249cb7549f15db30240f5ba95a3fafc4042432197547b92af23c8476f8a6b98

  • SSDEEP

    12288:oAMOc+aZoNhChWtbK45UvSmG9D1TAk44idXvR8KahaHR:gZKCebJUamQN4i+R

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2