Extracted

• • Target

    a3d4af8e960db3a71927f672f29ece4963dd200965f9d3ddd3a2db8d4150f53c.exe

  • Size

    930KB

  • MD5

    dab02bda6040baa9dd55a267c40ef2ed

  • SHA1

    a114305562ece266d18b72f247651791f509f95e

  • SHA256

    a3d4af8e960db3a71927f672f29ece4963dd200965f9d3ddd3a2db8d4150f53c

  • SHA512

    b7325b4ad753c6fbec4c2ea6397edb9e686ec9896414f988abceb6a567a8f941381a225e4c39ca7acf9fe4dc2a5143392e8f01b2de0d740d6aefef70caf15ffa

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLmA61Ksm6EX7q8o2sE8mMLH:f3v+7/5QLmv1JKWbX7

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2