Extracted

• • Target

    c9c4df8ccf2d7149cf5c6ad5e630e5b8385ba3e8ec6d3cbf31d362abb57671b5.exe

  • Size

    922KB

  • MD5

    27e278b3f081e2912b69eafe4e67d551

  • SHA1

    a003df37c0d214dba9bbc8b041852354a43e00d7

  • SHA256

    c9c4df8ccf2d7149cf5c6ad5e630e5b8385ba3e8ec6d3cbf31d362abb57671b5

  • SHA512

    b912042baa589c99ee1f424b6c8e199ef9fe69f5678b0e40aed0e9820cce6d06364cfd51248a30a373d5c49198390d8e98cdd7e389ff8672d618f3b77ae60924

  • SSDEEP

    12288:dLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QWmqzbe7cJN+yt1AyPD2BRax2S:hfmMv6Ckr7Mny5QWmkC4JozkyB4x2S

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2