Extracted

• • Target

    f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe

  • Size

    11KB

  • MD5

    a0a010c6bc3aeca4c61b88d83b7bc4fc

  • SHA1

    82bff34d56ae4d659f32197b485681b3bee58b55

  • SHA256

    f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b

  • SHA512

    33c08b1a138fcf4d24f6a124d39d6ce937cd2f4a49c2a5076c4da64f14bf61e104e430bc92e672508c49d95ce2f4663bab4d77e36ff83a518a0a2ef0925ba0c1

  • SSDEEP

    192:zow9iG8qkoI0xF5H2nQfmG4NlUeKrfBzEL6:HkJKJGQP4NSeoBzEL

  Score

  10^/10

  discoverysnakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2