Extracted

• • Target

    1964205c3ba627bb974acd0338212de06cf442c95b7b1bd17647a2879407b3d8.exe

  • Size

    331KB

  • MD5

    56a0eb16583c87251084dee7f8e358d2

  • SHA1

    ef8f0c3826a8bfd08a670a68711146d2106886b8

  • SHA256

    1964205c3ba627bb974acd0338212de06cf442c95b7b1bd17647a2879407b3d8

  • SHA512

    789d4c056d7ef46da0f8614175179351221feee357af49e772ccfa4ad4180e58f1cec33d01e75eb9b0db6801ccbe80d8522f0bebda2e936e7e484944b970e30e

  • SSDEEP

    768:RbLdbQe2VzEjss2yXg1ILcn0sspAgpq80Lyg1uMN0+dzsRU+eEyl:R5Q7E/pqrLy0uyz+fyl

  Score

  10^/10

  snakekeyloggercollectionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2