Extracted

• • Target

    1546c45496290063818a4e24b240aa8cd88c8023dccb2876706a569a0359be9e.exe

  • Size

    499KB

  • MD5

    a56e9ac0bdfb2994a47cff685f5082a8

  • SHA1

    855fef6a65caf563685f757a11b653a43472e4be

  • SHA256

    1546c45496290063818a4e24b240aa8cd88c8023dccb2876706a569a0359be9e

  • SHA512

    97bb5879e5a1be00eb980a5e51a6caa69fa4e5731e377236c4abf3b9cdaa7a5ef0b3040feb468c219e80ad42b49049f0fb74d3843bf896a4d23a947804a73342

  • SSDEEP

    12288:62UScVclz+IuSqKixs7p2JYQE3Pu98rxG6ortJ6zdhp:6UcVuSpW/3RN

  Score

  10^/10

  snakekeyloggerdiscoveryexecutionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2