Extracted

Extracted

• • Target

    ebf8c70201f3fa543de8bc8a93f96f04d39b09f99e39a30729eafb033d2cf14b.exe

  • Size

    763KB

  • MD5

    f063df845a7bfb23a59cb8c8e5fa28eb

  • SHA1

    a80bf8e2cc122c95a145a34d96da39ad9224bd40

  • SHA256

    ebf8c70201f3fa543de8bc8a93f96f04d39b09f99e39a30729eafb033d2cf14b

  • SHA512

    94de5c5137edebd31b8d048fb87a8682e4d3a7f37ead13c8e50ff5ca05c1a174625138ac4edb794e0a82ad6e30d3955299612de10a6010e2730f1b0b824f864e

  • SSDEEP

    12288:CMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IiKt9j:CnsJ39LyjbJkQFMhmC+6GD9lm

  Score

  10^/10

  discoverypersistencesnakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2