Extracted

• • Target

    608f84de59bd55d949b1188fd1b7e1bc5bd6607b2a69bbf1fb4a9420fbfda2aeN

  • Size

    513KB

  • MD5

    acae534e5a5378ad442627c004e243e0

  • SHA1

    8bee01da1a5a0a901b565b0d655997c4ee9bb271

  • SHA256

    608f84de59bd55d949b1188fd1b7e1bc5bd6607b2a69bbf1fb4a9420fbfda2ae

  • SHA512

    29d49a84d8bf017be31caef65da7b4d23657ca843b1ed039ad52edd8ebb52c6862fb4036d65a06f9a6c17c5f090da3fbac31cec17ec53b12607d89343aaa2c13

  • SSDEEP

    12288:nUSl9Hj2dWAfEd7/l5t1dvMSwMpIxlto6X4o:Pl9j4g/lP1BMSh4ltD

  Score

  10^/10

  snakekeyloggerdiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2