Extracted

• • Target

    taskhostws.exe

  • Size

    938KB

  • MD5

    b47e4f366b08fe509c2a8f9ee7251f51

  • SHA1

    3338dd3e335d1e8e6ee0d4c0c607248d333c25c1

  • SHA256

    03461c2a07431aed5ff68bbcf42d7ef82f32190b44ba140befd3f474614b5f3d

  • SHA512

    277032b371ca4992657c172995186b4593197a91c784e84b1b5652478d462b84792e8b10480ecf0eb05e4ce4130575c59f0f14d197d4e0d77c70c0bd6989aaec

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLLxANAeGFvgGZ7O1nk5ns:f3v+7/5QLtWAeG6GUC5ns

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2