Extracted

• • Target

    3e2f27edd3deacd8f08f6ed1133b2040.exe

  • Size

    948KB

  • MD5

    3e2f27edd3deacd8f08f6ed1133b2040

  • SHA1

    060e3218949c5a006bb8607e8228e6539b737bfb

  • SHA256

    163a25e2b68ed09eb4cf82f28c87568969091764bdfb4140b4675a00e2d2ed86

  • SHA512

    da437c39e3337f6750c3b9353c71999c16415ec1fecdaa4bba676bb12207cb51a7258b91b175d1893ae4e9111fa9ccf027151ad7527d9d78df59f86436cfdb42

  • SSDEEP

    12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLhXfyaU9nV6iwCqg3ICHxX6i6fUTRZL:ffmMv6Ckr7Mny5QLtqa8V6iwCqgbHEoL

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2