Extracted

• • Target

    XYCKW_file.exe

  • Size

    935KB

  • MD5

    daaa8ac3995fb610eda2e52a639d191f

  • SHA1

    2a26a631b79878c461248d5c03a33fb312aedb05

  • SHA256

    e82aa9f8f95f53d306db35e28e6fdd4dd16eba7d7437971f929d3cf5470267b7

  • SHA512

    808c18d514439aead5759bd3d1bfbfb1b31cfb6c03a147db8525aa8f7dec30fb4b73a12b4e4310f97b9917f6513594d917184434f49ff9a5ee1870c46ae75157

  • SSDEEP

    12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QL2wiaLQQbtWvZNrtLFAL6B2meNN0d:ffmMv6Ckr7Mny5QLL5b4l5N2mxd

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2