Extracted

• • Target

    805fb7de61b3cf5af10f0e090cb03ce0b7fa7c7cb160ddaa285481e6cd5b8b44.exe

  • Size

    9KB

  • MD5

    bf3e6a24ef1d06cebf8e0c9930f352aa

  • SHA1

    9e581034223ffb6f9a5f7af813c2967701ad426d

  • SHA256

    805fb7de61b3cf5af10f0e090cb03ce0b7fa7c7cb160ddaa285481e6cd5b8b44

  • SHA512

    18b908f7634a9c7b9afd8e19469521dff6fc7b6e102450810c742f2e8fb1f45750ea04ec5e385b71360da249a0c9133016e4416acbb0e90077382b3c04fc8fa4

  • SSDEEP

    192:tDhHj0XMZpjsb6mvUT59gcaW7p35Yw55oY0kN5J/K:rHUGpauzgcn7p35d5gq

  Score

  10^/10

  discoverysnakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2