Extracted

• • Target

    b722f65934d50bc3aa573df5e87aeceecf4b62bb612f8d8d6470a845964fe113N

  • Size

    945KB

  • MD5

    def34f8ed7e2e6068efefafd3cbbe640

  • SHA1

    ada1cce3435741799478d6527323812f55bae852

  • SHA256

    b722f65934d50bc3aa573df5e87aeceecf4b62bb612f8d8d6470a845964fe113

  • SHA512

    ec5c100e3ea712e10a32ad6170d5ee4a4eb3ed5402f3c69758c3ecdf007fd9567e70055aee44958c77d96719ccef5cfe3e00cead7aa85c9b0fd20584fabe8d44

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLbQY6z/EfPO8pwcGh5:f3v+7/5QLURIXOwwT5

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2