Extracted

• • Target

    malw.exe

  • Size

    906KB

  • MD5

    47cda90a6bd1acf43023271ec85128b1

  • SHA1

    8e61eb3faa1434d687531c46cfdc4f8030f7f214

  • SHA256

    03bbc95cc519a5dba31556b9caa15f73eb3b72a63f6de2ead954c590f6a15a60

  • SHA512

    dc3d5237f950ccbdea086aea9b57b19ba161d178dcabb92b87680deaa6720dc582caef710a90794457ecfb246e7eea6baf3c55a54f34ce2e81dd628321120ee8

  • SSDEEP

    24576:9YSEdShZs3/2c+U/clskc6HXx7nrQKgp5O1RmP9tUken:S/dShZm2skrnrkpWmltgn

  Score

  10^/10

  persistencesnakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2